Apache Kafka's code-generated protocol readers pre-allocate array collections based on a declared element count that is only loosely validated against the request buffer size. This can lead to excessive heap allocation before elements are read, enabling an attacker to cause an OutOfMemoryError and crash the broker. The vulnerability affects all Kafka API types with array fields and occurs before authorization checks, allowing unauthenticated attackers on unauthenticated listeners to exploit it. Fixed in Apache Kafka versions 4.2.2, 4.3.2, and 4.4.0 by capping pre-allocation and rejecting excessively large array lengths.