Vulnerabilities of Red Hat streams for Apache Kafka 3

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-118952	A flaw was found in the Kroxylicious ACL authorizer	6.5 Medium	Oct 30, 2026
CVE-2026-105941	The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes…	8.1 High	Oct 20, 2026
CVE-2026-105949	Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a…	8.8 High	Oct 20, 2026
CVE-2026-105312	A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…	9.9 Critical	Oct 20, 2026
CVE-2026-105311	The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…	7.7 High	Oct 20, 2026
CVE-2026-96740	A flaw was found in the StreamsHub Console for Apache Kafka	6.5 Medium	Sep 28, 2026
CVE-2026-57915	It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized…	Not rated	Jun 26, 2026
CVE-2026-54513	jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor	8.1 High	Jun 23, 2026
CVE-2026-50559	Quarkus is a Java framework for building cloud-native applications	7.5 High	Jun 19, 2026
CVE-2026-50010	Netty is a network application framework for development of protocol servers and clients	7.5 High	Jun 12, 2026
CVE-2026-48059	Netty is a network application framework for development of protocol servers and clients	8.7 High	Jun 12, 2026
CVE-2026-48043	Netty is a network application framework for development of protocol servers and clients	5.3 Medium	Jun 12, 2026
CVE-2026-47691	Netty is a network application framework for development of protocol servers and clients	8.7 High	Jun 12, 2026
CVE-2026-45674	Netty is a network application framework for development of protocol servers and clients	8.7 High	Jun 12, 2026
CVE-2026-45416	Netty is a network application framework for development of protocol servers and clients	7.5 High	Jun 12, 2026
CVE-2026-44893	Netty is a network application framework for development of protocol servers and clients	7.5 High	Jun 12, 2026
CVE-2026-44249	Netty is a network application framework for development of protocol servers and clients	8.1 High	Jun 11, 2026
CVE-2026-40984	In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service…	7.5 High	Jun 9, 2026
CVE-2026-40983	In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service…	7.5 High	Jun 9, 2026
CVE-2026-27145	(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…	6.5 Medium	Jun 2, 2026
CVE-2026-39821	The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label	9.6 Critical	May 22, 2026
CVE-2026-42587	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42584	Netty is an asynchronous, event-driven network application framework	7.3 High	May 13, 2026
CVE-2026-42579	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42578	Netty is an asynchronous, event-driven network application framework	2.9 Low	May 13, 2026

Other Red Hat products