CVE-2026-111551: Apache Kafka deserialization denial of service via oversized allocation

CVE-2026-111551 · Severity: info · Published 2026-10-28

Apache Kafka, a distributed messaging platform, contains multiple deserialization vulnerabilities where untrusted data can declare oversized memory allocations. An attacker can craft malicious messages or metadata to trigger out-of-memory errors that crash Kafka Streams applications or consumer processes, causing service interruption. The broker cluster itself remains unaffected, but individual applications reading the poisoned data will fail on processing and restart.

Technologies: Apache Kafka. Vendors: Apache.

Quick answers

Is CVE-2026-111551 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111551 being exploited in the wild.
How severe is CVE-2026-111551?
Informational severity, published 28 October 2026.
Which products and versions are affected?
Apache Kafka before 4.2.2, 4.3.2, 4.4.0.
Is there a fix for CVE-2026-111551?
Yes: fixed in 4.2.2, 4.3.2, 4.4.0. Until then: Where authorization is enabled, restrict write access to each application's internal topics and consumer group to its own principal, and restrict who can produce to topics consumed with ListSerde. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111551 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-111551?
Check whether you run Apache Kafka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.2.2, 4.3.2, 4.4.0

Where authorization is enabled, restrict write access to each application's internal topics and consumer group to its own principal, and restrict who can produce to topics consumed with ListSerde.

Technical details

Multiple deserialization paths in Kafka Streams and the clients library read size or count fields from untrusted input and use them directly for array or buffer allocation without validating against remaining input bytes. Affected components include ProcessorRecordContext, ChangedDeserializer, CombinedKeySchema, ProcessorMetadata, AssignmentInfo, and ListDeserializer. An attacker can write crafted records to internal topics, consumer group metadata, or application-consumed topics to trigger multi-gigabyte allocations and OutOfMemoryError crashes; the poisoned data persists and causes failures on restart.

Affected products

  • Apache Kafka before 4.2.2, 4.3.2, 4.4.0

Timeline

  • 2026-10-28: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.