Zero Radar
← feed
HighVulnerabilityCVE-2026-114349updated 28 Oct 2026, 17:46 UTC

Apache Kafka brokers can be crashed by a crafted compressed message

A user who is allowed to write to a Kafka topic can send one small, specially built message that makes the broker try to reserve a huge amount of memory. This can crash the broker or stop log cleanup until the bad message is removed.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesApache Kafka 4.2.2, 4.3.2, and 4.4.0, plus setting max.decompressed.message.bytes to a bounded value (the default is effectively unlimited, so upgrading alone is not enough). · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Authorized writerHolds Write access to a topic
  2. 2Crafted batchSmall compressed batch declares about 2 GiB
  3. 3Broker decodesAllocates buffer before size check
  4. 4Out of memoryRequest threads or broker JVM crash
  5. 5Log cleaner diesCompaction stops for the whole broker
  6. ResultBroker availability is denied

What happened

Kafka brokers allocate a buffer sized by an attacker-controlled declared body size inside compressed record batches before validating it, enabling unbounded memory allocation (OutOfMemoryError) during decoding and log compaction.

Why it is dangerous: A single request can crash broker threads or the whole broker JVM when ExitOnOutOfMemoryError is set, and on compacted topics it can permanently stop log compaction for the broker, including internal offset and transaction topics. Availability only; no data is disclosed or altered.

Are you affected?

You are affected if you run Apache Kafka 0.11.0.0 through 4.1.2, 4.2.0 through 4.2.1, or 4.3.0 through 4.3.1, and any principal has Write access to a topic.

Apache Kafka 0.11.0.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1

What to do

  1. Upgrade Apache Kafka to 4.2.2, 4.3.2, or 4.4.0
  2. Set max.decompressed.message.bytes at the broker and/or topic level to a bounded value above your largest legitimate decompressed record and well below the broker heap divided by thread count
  3. Until upgraded and configured, restrict Write access to trusted producers only; quotas and max.message.bytes do not mitigate this

Timeline

  1. 28 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 17:44 UTC
    Reported by oss-security · oss-security
  3. 28 Oct 2026, 17:46 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 17:46 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-114349
Disclosed
28 Oct 2026, 17:17 UTC
On Zero Radar
28 Oct 2026, 17:46 UTC (28 min after disclosure)
Last change
28 Oct 2026, 17:46 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Kafka brokers can be crashed by a crafted compressed message · Zero Radar