Apache Software Foundation Apache Kafka
23 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114349 | 0.11.0.0 – < 2.5.0 | Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches | ||||
| CVE-2026-112375 | 3.2.0 – 4.1.2 ; 4.2.0 – 4.2.1 ; 4.3.0 – 4.3.1 | Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs | ||||
| CVE-2026-116593 | 2.4.0 – < 4.2.2 ; 4.3.0 – < 4.3.2 | Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint | ||||
| CVE-2026-115644 | 2.4.0 – < 4.2.2 ; 4.3.0 – < 4.3.2 | Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions | ||||
| CVE-2026-111551 | 0.10.0.0 – 4.1.2 ; 4.2.0 – 4.2.1 ; 4.3.0 – 4.3.1 | Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation | ||||
| CVE-2026-111496 | 1.1.0 – 4.1.2 ; 4.2.0 – 4.2.1 ; 4.3.0 – 4.3.1 | Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation | ||||
| CVE-2026-111115 | 2.4.0 – 4.1.2 ; 4.2.0 – 4.2.1 ; 4.3.0 – 4.3.1 | Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing | ||||
| CVE-2026-111108 | 3.3.0 – 4.1.2 ; 4.2.0 – 4.2.1 ; 4.3.0 – 4.3.1 | Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers | ||||
| CVE-2026-111073 | 3.7.0 – 4.1.2 ; 4.2.0 – 4.2.1 ; 4.3.0 | Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of s… | ||||
| CVE-2026-110985 | 4.1.0 – 4.1.2 ; 4.2.0 – 4.2.1 ; 4.3.0 | Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured | ||||
| CVE-2026-110952 | 3.1.0 – < 4.4.0 | Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default | ||||
| CVE-2026-83525 | 2.8.0 – < 4.2.2 ; 4.3.0 – < 4.3.2 | Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller … | ||||
| CVE-2026-41115 | 4.0.0 – 4.3.0 | Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-33557 | 4.1.0 – 4.1.1 | Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication | CRITICAL 9.1 | 0.9 % | ||
| CVE-2026-33558 | 0.11.0 – 3.9.1 ; 4.0.0 | Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output | MEDIUM 5.3 | 0.6 % | ||
| CVE-2025-27819 | 2.0.0 – 3.3.2 | Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration | HIGH 7.5 | 1.0 % | ||
| CVE-2025-27818 | 2.3.0 – 3.9.0 | Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration | HIGH 8.8 | 1.1 % | ||
| CVE-2024-56128 | 0.10.2.0 – < 3.7.2 ; 3.8.0 | Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption | MEDIUM 5.3 | 0.8 % | ||
| CVE-2024-27309 | 3.5.0 – 3.5.2 ; 3.6.0 – 3.6.1 | Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode | HIGH 7.4 | 1.1 % | ||
| CVE-2022-34917 | Apache Kafka 2.8.0 2.8.0 ; Apache Kafka 2.8.1 2.8.1 ; Apache Kafka 3.0.0 3.0.0 ; … | Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers | HIGH 7.5 | 1.5 % | ||
| CVE-2021-38153 | Apache Kafka 2.0.x – 2.0.1 ; Apache Kafka 2.1.x – 2.1.1 ; Apache Kafka 2.2.x – 2.2.2 ; … | Timing Attack Vulnerability for Apache Kafka Connect and Clients | MEDIUM 5.9 | 6.2 % | ||
| CVE-2018-1288 | 0.9.0.0 to 0.9.0.1 ; 0.10.0.0 to 0.10.2.1 ; 0.11.0.0 to 0.11.0.2 ; … | In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action rese | MEDIUM 5.4 | 4.8 % | ||
| CVE-2017-12610 | 0.10.0.0 to 0.10.2.1 ; 0.11.0.0 to 0.11.0.1 | In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted prot | MEDIUM 6.8 | 2.9 % |