| CVE-2026-114349 |
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-112375 |
Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-116593 |
Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-115644 |
Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-111551 |
Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-111496 |
Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-111115 |
Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-111108 |
Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-111073 |
Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-110985 |
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-110952 |
Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-83525 |
Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
|
Not rated
|
Oct 28, 2026 |
| CVE-2026-41115 |
An improper authorization vulnerability has been identified in Apache Kafka
|
Not rated
|
Jun 2, 2026 |
| CVE-2026-33557 |
A possible security vulnerability has been identified in Apache Kafka
|
Not rated
|
Apr 20, 2026 |
| CVE-2026-33558 |
Information exposure vulnerability has been identified in Apache Kafka
|
Not rated
|
Apr 20, 2026 |
| CVE-2025-27819 |
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka…
|
Not rated
|
Jun 10, 2025 |
| CVE-2025-27818 |
A possible security vulnerability has been identified in Apache Kafka
|
Not rated
|
Jun 10, 2025 |
| CVE-2024-56128 |
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation
|
Not rated
|
Dec 18, 2024 |
| CVE-2024-27309 |
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be…
|
Not rated
|
Apr 12, 2024 |
| CVE-2022-34917 |
A security vulnerability has been identified in Apache Kafka
|
Not rated
|
Sep 20, 2022 |
| CVE-2021-38153 |
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks…
|
Not rated
|
Sep 22, 2021 |
| CVE-2018-1288 |
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may…
|
Not rated
|
Jul 26, 2018 |
| CVE-2017-12610 |
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a…
|
Not rated
|
Jul 26, 2018 |