Apache Software Foundation Apache Kafka

• CVE-2026-114349 Medium 6.5 Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches 0.5%
• CVE-2026-112375 Medium 6.5 Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs 0.6%
• CVE-2026-116593 High 8.1 Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint 0.5%
• CVE-2026-115644 High 8.8 Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions 0.5%
• CVE-2026-111551 High 7.5 Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation 0.5%
• CVE-2026-111496 Critical 9.1 Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation 0.5%
• CVE-2026-111115 Critical 9.1 Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing 0.6%
• CVE-2026-111108 Critical 9.1 Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers 0.6%
• CVE-2026-111073 Medium 6.5 Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service 0.4%
• CVE-2026-110985 Critical 9.1 Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured 0.2%
• CVE-2026-110952 Medium 5.9 Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default 0.1%
• CVE-2026-83525 Medium 6.5 Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request. 0.3%
• CVE-2026-41115 Medium 4.3 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API 0.3%
• CVE-2026-33557 Critical 9.1 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication 0.9%
• CVE-2026-33558 Medium 5.3 Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output 0.6%
• CVE-2025-27819 High 7.5 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration 1.1%
• CVE-2025-27818 High 8.8 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration 1.1%
• CVE-2024-56128 Medium 5.3 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption 0.8%
• CVE-2024-27309 High 7.4 Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode 1.1%
• CVE-2022-34917 High 7.5 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers 1.5%
• CVE-2021-38153 Unrated Timing Attack Vulnerability for Apache Kafka Connect and Clients 6.2%