CVE-2026-114349 is a vulnerability in Apache Kafka where the broker allocates memory based on an attacker-controlled declared decompressed record size without proper validation. This can lead to OutOfMemoryError conditions, crashing request-handler threads or the broker JVM if configured to exit on such errors. Additionally, crafted records can cause the log-cleaner thread to terminate permanently, stopping log compaction and impacting broker availability. No data disclosure or alteration occurs.
CVE-2026-112375 is a missing authorization vulnerability in Apache Kafka that allows an authenticated principal without any authorization grants to read files or environment variables from the broker host. This occurs because configuration validation happens before authorization checks, enabling resolution of configuration variables that expose sensitive data. The issue affects Kafka versions from 3.2.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. The vulnerability is mitigated in versions 4.2.2, 4.3.2, and 4.4.0 by enforcing authorization before configuration validation and restricting config-provider usage. Running brokers under least-privileged OS accounts is recommended as additional defense.
Apache Kafka contains a vulnerability in its flexible protocol request parsing where the count of tagged fields is not properly bounded, allowing a client to declare an extremely large number of tagged fields in a request header. This can cause excessive memory allocation on the broker, leading to OutOfMemoryError or severe garbage collection delays, resulting in denial of service. The issue affects Kafka versions from 2.4.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. Fixed versions include 4.2.2, 4.3.2, and 4.4.0, where the tagged-field count is properly validated and capped before allocation.
CVE-2026-111108 is a resource allocation vulnerability in Apache Kafka's protocol readers that allows an attacker to cause excessive heap memory allocation by declaring large array sizes in requests. This occurs before authorization checks, enabling unauthenticated attackers on unauthenticated listeners to crash the broker with OutOfMemoryError. The issue affects Kafka versions from 3.3.0 through 4.3.1. Fixed versions include 4.2.2, 4.3.2, and 4.4.0, which implement caps on array pre-allocation and reject overly large array declarations.
CVE-2026-111073 is a vulnerability in Apache Kafka's PushTelemetry API where the broker validates only the compressed size of telemetry data before decompression. This allows an authenticated client to send a small compressed payload that decompresses to a very large size, causing excessive heap memory consumption. This can lead to OutOfMemoryError, degrading or crashing the broker and potentially affecting cluster availability. The vulnerability affects Apache Kafka versions from 3.7.0 through 4.1.2, 4.2.0 through 4.2.1, and version 4.3.0. Fixed versions include 4.2.2, 4.3.1, and 4.4.0, which enforce a maximum decompressed size limit equal to telemetry.max.bytes (default 1 MB).
CVE-2026-110985 is a vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER authentication with the default JWT validator. If the configuration parameter sasl.oauthbearer.jwks.endpoint.url is not set and no custom verification key resolver is provided, the broker falls back to a validator that does not verify JWT signatures, algorithms, or issuers. This allows an unauthenticated remote attacker to forge any JWT token, including those asserting superuser privileges, gaining full cluster access. The issue affects specific Kafka versions prior to fixed releases. The vulnerability is resolved in Apache Kafka versions 4.2.2, 4.3.1, and 4.4.0, where the broker fails to start if signature verification is not properly configured.
Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator verify JWT signatures but do not enforce issuer and audience claim checks by default. This can allow tokens from different issuers or without audience claims to authenticate if the JWKS endpoint serves keys for multiple issuers. From version 4.4.0, Kafka requires explicit configuration of issuer and audience checks or allows opting out. Versions 3.1.0 through before 4.4.0 are affected if these settings are not configured.