{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111073", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-15T13:40:49.926Z", "datePublished": "2026-10-28T16:37:58.482Z", "dateUpdated": "2026-10-28T16:37:58.482Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:37:58.482Z"}, "title": "Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service", "problemTypes": [{"descriptions": [{"description": "CWE-409 Improper handling of highly compressed data (data amplification)", "lang": "en", "cweId": "CWE-409", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-770 Allocation of resources without limits or throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "cweId": "CWE-400", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "packageURL": "pkg:maven/org.apache.kafka/kafka", "versions": [{"status": "affected", "version": "3.7.0", "lessThanOrEqual": "4.1.2", "versionType": "semver"}, {"status": "affected", "version": "4.2.0", "lessThanOrEqual": "4.2.1", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.kafka:kafka"}], "descriptions": [{"value": "The broker-side PushTelemetry API (KIP-714) validates only the compressed size of\u00a0a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing\u00a0it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the\u00a0decompressed output size, growing a heap buffer until the compressed input is exhausted. A\u00a0small, highly compressible payload (for example gzip-compressed zeros) can therefore expand\u00a0to hundreds of megabytes of broker heap.\n\n\nImpact:\n\n\nAn authenticated client can send a PushTelemetry request with a small compressed payload that\u00a0decompresses to a very large size, consuming broker heap out of proportion to the request\u00a0size. Repeated or concurrent requests can exhaust the broker heap and cause an\u00a0OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers\u00a0can affect cluster availability. PushTelemetry is available to any authenticated client and is\u00a0not gated by an ACL.\n\n\nMitigation:\n\n\nUpgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully\u00a0prevents the amplification, because telemetry.max.bytes bounds only the compressed size;\u00a0lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a\u00a0partial mitigation.\n\n\nResolution:\n\n\n- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed\u00a0size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and\u00a0aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an\u00a0over-large or highly compressible payload is rejected instead of being fully expanded in\u00a0heap. The decompressed size is therefore bounded by default.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The broker-side PushTelemetry API (KIP-714) validates only the compressed size of&nbsp;<span>a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing&nbsp;</span><span>it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the&nbsp;</span><span>decompressed output size, growing a heap buffer until the compressed input is exhausted. A&nbsp;</span><span>small, highly compressible payload (for example gzip-compressed zeros) can therefore expand&nbsp;</span><span>to hundreds of megabytes of broker heap.</span></div><br><div>Impact:</div><br><div>An authenticated client can send a PushTelemetry request with a small compressed payload that&nbsp;<span>decompresses to a very large size, consuming broker heap out of proportion to the request&nbsp;</span><span>size. Repeated or concurrent requests can exhaust the broker heap and cause an&nbsp;</span><span>OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers&nbsp;</span><span>can affect cluster availability. PushTelemetry is available to any authenticated client and is&nbsp;</span><span>not gated by an ACL.</span></div><br><div>Mitigation:</div><br><div>Upgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully&nbsp;<span>prevents the amplification, because telemetry.max.bytes bounds only the compressed size;&nbsp;</span><span>lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a&nbsp;</span><span>partial mitigation.</span></div><br><div>Resolution:</div><br><div>- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed&nbsp;<span>size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and&nbsp;</span><span>aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an&nbsp;</span><span>over-large or highly compressible payload is rejected instead of being fully expanded in&nbsp;</span><span>heap. The decompressed size is therefore bounded by default.&nbsp;</span></div>"}]}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Dawit Jeong <dev.d4v1d@gmail.com>", "type": "reporter"}, {"lang": "en", "value": "Apoorv Mittal <apoorvmittal10@gmail.com>", "type": "remediation developer"}, {"lang": "en", "value": "Andrew Schofield <aschofield@confluent.io>", "type": "remediation reviewer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kafka:kafka", "packageURL": "pkg:maven/org.apache.kafka/kafka", "product": "Apache Kafka", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.1.2", "status": "affected", "version": "3.7.0", "versionType": "semver"}, {"lessThanOrEqual": "4.2.1", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The broker-side PushTelemetry API (KIP-714) validates only the compressed size of\u00a0a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing\u00a0it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the\u00a0decompressed output size, growing a heap buffer until the compressed input is exhausted. A\u00a0small, highly compressible payload (for example gzip-compressed zeros) can therefore expand\u00a0to hundreds of megabytes of broker heap.\n\n\nImpact:\n\n\nAn authenticated client can send a PushTelemetry request with a small compressed payload that\u00a0decompresses to a very large size, consuming broker heap out of proportion to the request\u00a0size. Repeated or concurrent requests can exhaust the broker heap and cause an\u00a0OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers\u00a0can affect cluster availability. PushTelemetry is available to any authenticated client and is\u00a0not gated by an ACL.\n\n\nMitigation:\n\n\nUpgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully\u00a0prevents the amplification, because telemetry.max.bytes bounds only the compressed size;\u00a0lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a\u00a0partial mitigation.\n\n\nResolution:\n\n\n- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed\u00a0size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and\u00a0aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an\u00a0over-large or highly compressible payload is rejected instead of being fully expanded in\u00a0heap. The decompressed size is therefore bounded by default."}], "id": "CVE-2026-111073", "lastModified": "2026-10-28T17:17:38.300", "metrics": {}, "published": "2026-10-28T17:17:38.300", "references": [{"source": "security@apache.org", "url": "https://kafka.apache.org/cve-list"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-409"}, {"lang": "en", "value": "CWE-770"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{"created": "2026-10-28T17:30:15.427394+00:00", "updated": "2026-10-28T17:30:15.427400+00:00", "vendors": [], "weaknesses": ["CWE-400", "CWE-409", "CWE-770"]}