org.apache.kafka:kafka_2.12 vulnerabilities

CVEs whose affected-version data names the org.apache.kafka:kafka_2.12 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-114349None

6d ago

Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches

When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit.…

▾ SunlitApache Software Foundation · org.apache.kafka:kafka_2.11EPSS 0.25%via CVEORG