Apache Kafka CVE-2026-111551

Exploitation requires the ability to place crafted data on a path the victim deserializes, and the exact prerequisite differs per path. Kafka Streams internal paths (ProcessorRecordContext header count, ChangedDeserializer varint value length, CombinedKeySchema foreign-key length - which can also yield a negative size, ProcessorMetadata key length) require the attacker to write a crafted record to that application's internal changelog or repartition topics, or to commit crafted offset metadata to its consumer group. The AssignmentInfo path requires the attacker to be a member of the Streams consumer group and be elected group leader so it can return crafted group-assignment data. The ListDeserializer path requires that a consumer actually reads a topic using ListSerde and that the attacker can produce a crafted record to that topic. Limiting factors: where Kafka authorization (ACLs) is enabled, write access to internal topics, offset-metadata commits, and ListSerde-consumed topics is restricted to authorized principals, which blocks most paths; the ListSerde path is only reachable if ListSerde is in use; and impact is confined to denial of service of the consumer/Streams thread (no broker or cluster impact, no code execution, no data disclosure). The record size limit max.message.bytes does not limit exploitation because the allocation is driven by a declared size field, not by the record's actual byte length, and the crafted record persists so the crash recurs on restart.

No CVSS vector or score is provided in the input (CVSS: N/A), and no EPSS score is available, so quantitative exploitation-probability and severity signals cannot be compared - this is a notable data gap that should be flagged to the team. The remaining signals point to a moderate, availability-only issue: CWE-789 (memory allocation with excessive size value), impact strictly a denial of service via OutOfMemoryError on the affected consumer or Kafka Streams thread, with the broker and the rest of the cluster explicitly unaffected and no confidentiality or integrity impact. KEV status is not present (no active exploitation confirmed) and no public exploit or PoC reference is supplied. The vuln.today decision label is 'this_week', consistent with a prioritize-but-not-emergency DoS rather than a critical RCE. The practical risk is tempered by the fact that most reachable paths require the attacker to produce to a Streams application's internal changelog/repartition topics, commit crafted offset metadata to its consumer group, be a member of its consumer group (AssignmentInfo leader path), or produce to a topic consumed with ListSerde - access that is restricted in clusters with authorization enabled. The risk is elevated by persistence: a crafted record stays in the topic, so the crash recurs on restart, and max.message.bytes does not mitigate it because the allocation is driven by a declared size field, not by actual input length. Net: a real, worth-patching availability bug with a built-in re-crash loop, but not a high-urgency widespread-exploitation scenario on the evidence available.

An attacker able to produce to a vulnerable topic writes a single crafted record whose internal size/count field declares a very large value (for example into a topic consumed with ListSerde, or into a Kafka Streams internal changelog/repartition topic). When the consumer or Streams thread deserializes it, it allocates a multi-gigabyte buffer and dies with an OutOfMemoryError, and because the record persists the thread crashes again on every restart. No public exploit code is identified at time of analysis.