The attacker must be an authenticated principal with Write permission on a topic. They can send a small, CRC-valid compressed produce request whose decompressed record declares a body size of up to about 2 GiB.
No. max.message.bytes, request-size limits, and client or broker quotas limit the compressed wire size, but do not constrain the attacker-controlled declared size in the decompressed stream.
The broker request-handler path is reached when the compressed batch codec differs from the topic's compression.type and Kafka re-encodes the records. The allocation attempt can raise OutOfMemoryError and crash request-handler threads.
On brokers started with -XX:+ExitOnOutOfMemoryError, a single crafted request can terminate the broker. This option turns the allocation failure from a request-handler failure into a broker process exit.
Yes. Any consumer that fetches the crafted record can be denied service when processing it, in addition to the impact on broker request-handler threads.