https://seclists.org/oss-sec/2026/q4/418: CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

Q: Which Apache Kafka releases contain the fix?

Upgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. The affected ranges are 3.7.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0.

Q: Who can trigger the issue?

Any authenticated client can send the affected request. PushTelemetry is not protected by an ACL, so no additional ACL permission is required.

Q: Does the default telemetry.max.bytes setting prevent exploitation?

No. The default 1 MB limit applies only to the compressed payload size; it does not limit the size after decompression.

Q: How could this affect a Kafka cluster rather than one broker?

Repeated or concurrent requests can exhaust a broker's heap and cause an OutOfMemoryError. A client targeting multiple brokers can degrade or affect cluster availability.

Published Oct 28, 2026

Updated

Affected Software

1 affected component

Apache Kafka>=3.7.0<=4.1.2, >=4.2.0<=4.2.1, =4.3.0

Frequently Asked Questions

Which Apache Kafka releases contain the fix?

Upgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. The affected ranges are 3.7.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0.

Who can trigger the issue?

Any authenticated client can send the affected request. PushTelemetry is not protected by an ACL, so no additional ACL permission is required.

Does the default telemetry.max.bytes setting prevent exploitation?

No. The default 1 MB limit applies only to the compressed payload size; it does not limit the size after decompression.

How could this affect a Kafka cluster rather than one broker?

Repeated or concurrent requests can exhaust a broker's heap and cause an OutOfMemoryError. A client targeting multiple brokers can degrade or affect cluster availability.