Threats tagged 'ghsa-fpf4-qx46-w5rg'

Several Apache Kafka deserialization paths improperly use size or count fields from input data to allocate memory without verifying the actual available bytes. This can allow an attacker to craft inputs that cause large memory allocations, leading to OutOfMemoryError crashes in Kafka consumers or Kafka Streams threads. The issue affects internal Kafka Streams topics and consumers using ListSerde. The broker and cluster remain unaffected. Fixed in Apache Kafka versions 4.2.2, 4.3.2, and 4.4.0.