Apache Kafka EUVD-2026-112170

No special conditions - remote unauthenticated exploitation against default configurations of Apache Kafka brokers, because the flexible request header is parsed on the network thread before authentication, request dispatch, and quota accounting, and flexible APIs such as ApiVersions v3 use header version 2 by default; no Kafka resource ACL or quota is required. Limiting factors: the attacker needs network reachability to a broker listener, and the amplification is bounded by socket.request.max.bytes (lowering it reduces, but does not remove, exposure). Affected versions per EUVD are 2.4.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1; fixed in 4.2.2, 4.3.2, and 4.4.0, which bounds-check the tagged-field count (rejecting negative counts, counts exceeding remaining buffer bytes, or counts over a fixed maximum of 10,000) before any per-field allocation.

This is a pre-authentication, network-reachable denial-of-service in Apache Kafka brokers, and the signals point to a credible but not emergency priority. No CVSS vector was supplied by the source (CVSS: N/A), so severity must be assessed independently; based on the description this maps to a network/low-complexity/no-privilege availability impact (assessed 7.5). There is no CISA KEV listing and no EPSS score in the input, and no PoC or exploit reference is provided - so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week' rather than act_now/emergency, which is consistent with a vendor-reported, patch-available issue that is serious but not under observed active exploitation. The real-world concern is amplified by the fact that the malicious count is parsed in the flexible request header BEFORE authentication, dispatch, and quota accounting, so no ACL or credentials are required and quotas cannot throttle it; however, the impact is confined to availability (heap exhaustion / GC stalls / broker outage) with no stated confidentiality or integrity loss. Note a data conflict: the input Tags label this 'Information Disclosure,' which contradicts the description - the actual impact is denial of service, so that tag should not drive risk interpretation.

An unauthenticated client with network access to a broker listener sends a request of a few tens of megabytes whose flexible request header (e.g. ApiVersions v3) declares roughly 20 million tagged fields, each encodable in as little as two bytes. The broker's network thread allocates one RawTaggedField object per declared field before any authentication, exhausting heap or inducing process-wide GC stalls and denying service. No public exploit or PoC is identified in the available sources.