Log in Start free

Vulnerability · Published Jun 10, 2025 · Assigned by apache

CVE-2025-27819Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration

High 7.5

In plain English

A high-severity unsafe deserialization in Apache Kafka from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 34.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.kafka:kafka_2.10no fix listedGHSA-mcwh-c9pg-xw43
Mavenorg.apache.kafka:kafka_2.11no fix listedGHSA-mcwh-c9pg-xw43
Mavenorg.apache.kafka:kafka_2.123.4.0GHSA-mcwh-c9pg-xw43
Mavenorg.apache.kafka:kafka_2.133.4.0GHSA-mcwh-c9pg-xw43
Mavenorg.apache.kafka:kafka_2.8.0no fix listedGHSA-mcwh-c9pg-xw43
Mavenorg.apache.kafka:kafka_2.8.2no fix listedGHSA-mcwh-c9pg-xw43
Mavenorg.apache.kafka:kafka_2.9.1no fix listedGHSA-mcwh-c9pg-xw43
Mavenorg.apache.kafka:kafka_2.9.2no fix listedGHSA-mcwh-c9pg-xw43

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Kafka 2.0.0 – through 3.3.2

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References