# CVE-2026-114349: Apache Kafka memory exhaustion in compressed record batch decoding

Source: https://junglewise.ai/threats/cve-2026-114349-when-a-broker-decodes-a-compressed-record-batch-the-per-record  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-114349 · Severity: info · Published 2026-10-28

Apache Kafka is a messaging platform that brokers use to reliably queue and distribute data to consumers. A flaw in how brokers decode compressed messages allows an authenticated attacker to send a specially crafted small request that tricks the broker into attempting to allocate up to 2 GB of memory, causing the broker process to crash and deny service. In severe cases, this prevents log compaction from running, halting critical internal operations until manual intervention.

Technologies: [Apache Kafka](https://junglewise.ai/threats/technologies/kafka). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-114349 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114349 being exploited in the wild.

**How severe is CVE-2026-114349?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Apache Kafka before 4.2.2, 4.3.2, 4.4.0.

**Is there a fix for CVE-2026-114349?** Yes: fixed in Apache Kafka 4.2.2, 4.3.2, 4.4.0. Until then: Set max.decompressed.message.bytes to a bounded value appropriate for your workload at the broker or topic level; this configuration defaults to effectively unlimited (2 GiB) for backward compatibility, so upgrading alone does not fully mitigate the issue. Until you upgrade and configure this limit, restrict Write access to trusted producers.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114349 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-114349?** Check whether you run Apache Kafka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache Kafka 4.2.2, 4.3.2, 4.4.0

Set max.decompressed.message.bytes to a bounded value appropriate for your workload at the broker or topic level; this configuration defaults to effectively unlimited (2 GiB) for backward compatibility, so upgrading alone does not fully mitigate the issue. Until you upgrade and configure this limit, restrict Write access to trusted producers.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"}]

## Technical details

When a broker decodes a compressed record batch, it reads an attacker-controlled declared body size from the decompressed stream and allocates a buffer without first validating the size against configured limits or available memory. The record size limit (max.message.bytes), request limits, and quotas only bound the compressed wire size, not the declared decompressed size. An authenticated Write principal can send a ~90-byte CRC-valid compressed produce request declaring a body size up to 2 GiB, triggering OutOfMemoryError in request-handler threads, log-cleaner threads, or consumers; when the error occurs in a log-cleaner thread on a compacted topic, log compaction permanently halts across the broker until the offending record is removed.

## Affected products

- Apache Kafka before 4.2.2, 4.3.2, 4.4.0

## Related threats

- [Apache Kafka incorrect operator in FetchSnapshot RPC handler](https://junglewise.ai/threats/cve-2026-83525-incorrect-operator-cwe-480-in-the-fetchsnapshot-rpc-handler-in)
- [Apache Kafka information disclosure via ConfigProvider in AlterConfigs](https://junglewise.ai/threats/cve-2026-112375-an-authenticated-kafka-principal-with-no-authorization-grants)
- [Apache Kafka deserialization denial of service via oversized allocation](https://junglewise.ai/threats/cve-2026-111551-several-kafka-deserialization-paths-read-a-size-or-count-field)
- [Apache Kafka unbounded tagged-field allocation in flexible protocol headers](https://junglewise.ai/threats/cve-2026-111115-apache-kafka-s-code-generated-readers-for-flexible-protocol)
- [Apache Kafka denial of service in protocol parsing](https://junglewise.ai/threats/cve-2026-111108-apache-kafka-s-code-generated-protocol-readers-pre-size-an-array)