Brokers with listeners that do not require authentication, such as PLAINTEXT listeners, are directly exposed because request parsing occurs before authorization. An unauthenticated attacker able to reach such a listener can trigger the allocation behavior.
The attacker needs network access to a vulnerable broker listener and can send a few concurrent requests with a very large declared array length. The requests can be only a few tens of megabytes on the wire while causing heap allocations several times larger, resulting in an OutOfMemoryError.
No. The vulnerable allocation pattern is generated into every protocol reader, affecting Kafka API types that contain an array field.
Require authentication on reachable broker listeners and prevent untrusted network clients from connecting to them. This removes the unauthenticated attack path described for listeners such as PLAINTEXT.