Improperly Controlled Sequential Memory Allocation Affecting org.apache.kafka:generator package, versions [2.4.0,4.2.2)[4.3.0,4.3.2)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHEKAFKA-22150296
- published3 Nov 2026
- disclosed28 Oct 2026
- creditMufeed VH, Vivek R
Introduced: 28 Oct 2026
NewCVE-2026-111115 (opens in a new tab)How to fix?
Upgrade org.apache.kafka:generator to version 4.2.2, 4.3.2 or higher.
Overview
Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation via generated flexible-protocol message readers that parse request headers. An attacker can send a request whose flexible header declares millions of unknown tagged fields, causing the readers to retain a RawTaggedField object for each field and exhaust broker heap or trigger process-wide GC stalls. Because the header is parsed on the network thread before authorization and request-time quota accounting, this can occur before authentication when using pre-authentication APIs such as ApiVersions v3.
Notes
- At the header-parsing step, the declared field count is bounded only by the outer request frame limit,
socket.request.max.bytes; lowering that setting reduces the maximum allocations one request can trigger but does not eliminate the attack.
Workarounds
- Lower
socket.request.max.bytesto limit the size of requests and reduce the number of tagged fields an attacker can declare; this reduces, but does not eliminate, exposure. - Restrict network access to broker listeners to trusted clients to reduce the chance that untrusted clients can send malicious request headers.