Threats tagged 'ghsa-7xcv-9qfj-9q57'

Apache Kafka's flexible protocol version readers do not properly limit the count of tagged fields declared by the sender, allowing a client to specify an excessively large number of tagged fields in request headers. This can cause the broker to allocate a large number of objects, exhausting heap memory or causing significant garbage collection delays, resulting in denial of service. The issue affects the parsing of flexible request headers, including pre-authentication APIs, allowing exploitation without authentication. Fixed in Apache Kafka versions 4.2.2, 4.3.2, and 4.4.0 by adding bounds checks on the tagged-field count.