Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 3.3.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several...
CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/417
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline November 5, 2026 Timothy Amerson BLOG 5 min. TL;DR – GAO’s latest report shows why waiting for the compliance…
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve…
A Hybrid Approach for Automated Security Pattern Recovery
arXiv:2611.05823v1 Announce Type: new Abstract: Security-by-design emphasises integrating security into software design and development. Security pattern catalogues…
PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures
arXiv:2611.06036v1 Announce Type: new Abstract: Processing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and…
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
arXiv:2611.06477v1 Announce Type: new Abstract: Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce…
CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
Posted by Jan Schaumann on Nov 04 This Debian Security Advisory for CVE-2026-109518 in apt(1) seems worth sharing more widely…