Endor Labs AI SAST Finds Two Apache Kafka Zero-Days: Unbounded Memory Allocation from Brokers to Kafka Streams

Apache Kafka fixed two denial-of-service vulnerabilities, CVE-2026-114349 and CVE-2026-111551, after an AI-assisted static analysis scan identified unbounded memory allocations driven by attacker-controlled size fields in compressed record decoding, client deserialization, and Kafka Streams assignment handling. Small crafted inputs could request allocations of up to roughly 2 GiB, crashing consumers, Kafka Streams applications, and in some configurations broker request handlers; a malicious compressed record could also silently terminate a broker’s log-cleaner thread and halt compaction of internal and user topics. The affected versions span Kafka releases from 0.10 or 0.11 through 4.3.1, with fixes available in 4.2.2, 4.3.2, and 4.4.0, although protection against the compressed-record issue additionally requires configuring the new max.decompressed.message.bytes limit because its default remains effectively unlimited for compatibility. The analysis traced untrusted data across module boundaries and protocols to allocation sinks, and Kafka maintainers expanded one fix to cover several related Streams deserialization paths. Recommended mitigations include upgrading, setting a suitable decompressed-message limit, restricting producer and consumer-group permissions, protecting Streams internal topics, and monitoring the log-cleaner dead-thread metric, since message-size limits and quotas do not constrain sizes declared within payloads.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.