GHSA-FPF4-QX46-W5RG
Vulnerability from github – Published: 2026-10-28 18:32 – Updated: 2026-10-28 21:31Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a multi-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext (header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length, which could also produce a negative size), ProcessorMetadata (key length), and AssignmentInfo group-assignment decoding; and, in the clients library, ListDeserializer (used by ListSerde).
Impact:
An attacker can trigger the oversized allocation and raise an OutOfMemoryError that crashes the affected consumer or Kafka Streams thread; the broker and the rest of the cluster are unaffected. The reachable surface depends on the path: writing a crafted record to a Streams application's internal changelog or repartition topics, or committing crafted offset metadata to its consumer group (Streams internal paths); writing a crafted record to any topic that a consumer reads with ListSerde (ListDeserializer); or, as a member of a Streams consumer group, returning crafted assignment data when elected leader (AssignmentInfo). Because a crafted record remains in its topic, the error can recur on restart. The record size limit (max.message.bytes) does not help, because the allocation is driven by a size field rather than by the input's length.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. Where authorization is enabled, restrict write access to each application's internal topics and consumer group to its own principal, and restrict who can produce to topics that are consumed with ListSerde.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: these deserialization paths validate the declared size against the remaining input before allocating and reject input that fails the check.
{
"affected": [],
"aliases": [
"CVE-2026-111551"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-28T17:17:39Z",
"severity": null
},
"details": "Several Kafka deserialization paths read a size or count field from input data and use it directly\u00a0to allocate an array, collection, or byte buffer, with no check against the bytes actually\u00a0available. A small crafted input can therefore declare a very large size and force a\u00a0multi-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext\u00a0(header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length,\u00a0which could also produce a negative size), ProcessorMetadata (key length), and AssignmentInfo\u00a0group-assignment decoding; and, in the clients library, ListDeserializer (used by ListSerde).\n\n\nImpact:\n\nAn attacker can trigger the oversized allocation and raise an OutOfMemoryError that crashes the\u00a0affected consumer or Kafka Streams thread; the broker and the rest of the cluster are unaffected.\u00a0The reachable surface depends on the path: writing a crafted record to a Streams application\u0027s\u00a0internal changelog or repartition topics, or committing crafted offset metadata to its consumer\u00a0group (Streams internal paths); writing a crafted record to any topic that a consumer reads with\u00a0ListSerde (ListDeserializer); or, as a member of a Streams consumer group, returning crafted\u00a0assignment data when elected leader (AssignmentInfo). Because a crafted record remains in its\u00a0topic, the error can recur on restart. The record size limit (max.message.bytes) does not help,\u00a0because the allocation is driven by a size field rather than by the input\u0027s length.\n\n\nMitigation:\n\nUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. Where authorization is enabled, restrict write\u00a0access to each application\u0027s internal topics and consumer group to its own principal, and restrict\u00a0who can produce to topics that are consumed with ListSerde.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: these deserialization paths validate the declared size\u00a0against the remaining input before allocating and reject input that fails the check.",
"id": "GHSA-fpf4-qx46-w5rg",
"modified": "2026-10-28T21:31:14Z",
"published": "2026-10-28T18:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111551"
},
{
"type": "WEB",
"url": "https://kafka.apache.org/cve-list"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/13"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.