News · via oss-security
CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 3.7.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 Description: The broker-side…