CVE-2026-114349: When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the de

Routine

HIGH n/aWATCHLIST

CVE-2026-114349 is a high-severity flaw (CVSS n/a) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to att

Why this priority

On your watchlist

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	n/a (High)
EPSS exploit chance	n/a
CISA exploited list	No
Weakness	CWE-400, CWE-789, CWE-1284
Published	2026-10-28
Last modified	2026-10-28

Publisher (CNA): Apache Software Foundation

Last updated 2026-10-28 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-10-28 17:17 UTCPublished CVE record published
2026-10-28 17:17 UTCUpdated Record last modified

Advisories and coverage

Research and news

oss-security list: CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches 2026-10-28

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-114349?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-114349 being exploited?

CVE-2026-114349 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-114349 affect?

CVE-2026-114349 affects affected software. Severity is high (CVSS n/a). When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. Th

How urgent is CVE-2026-114349?

Priority 5/100. On your watchlist

References

← Back to latest CVEs