Threats tagged 'ghsa-r6fp-x62f-pxfv'

The broker-side PushTelemetry API in Apache Kafka versions prior to 4.2.2, 4.3.1, and 4.4.0 validates only the compressed size of telemetry payloads before decompressing them. This allows an authenticated client to send a small compressed payload that decompresses to a very large size, consuming excessive broker heap memory. This can lead to OutOfMemoryError conditions, degrading or crashing the broker and potentially affecting cluster availability. The vulnerability is mitigated in Apache Kafka 4.2.2, 4.3.1, and 4.4.0 by enforcing a maximum decompressed size equal to telemetry.max.bytes, aborting decompression if exceeded.