CVE-2026-111115 — Apache Kafka broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

Apache Kafka's generated readers for flexible protocol requests can allocate a very large number of objects based on a tagged-field count supplied by the sender, exhausting broker heap or causing process-wide garbage-collection stalls and denying broker service.