Preliminary research

Endor Labs AI SAST Finds Two Apache Kafka Zero-Days: Unbounded Memory Allocation from Brokers to Kafka Streams

Peyton Kennedy · Endor Labs · 28 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Attacker-declared lengths escape compressed wire limits, persist in records and kill a shared log cleaner; a separate consumer-assignment path lets low-privilege group members drive allocations in peers.

Record

Researcher

Peyton Kennedy

Published by

Endor Labs

Date

28 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• dos
• compression
• parser-differential
• access-control

This page is the archive's own catalogue record. The research is the work of Peyton Kennedy, first published at the original source. Preserved copies are kept so the citation survives its host.