# Apache Software Foundation Apache Kafka.

Every CVE that names Apache Software Foundation Apache Kafka among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches](https://agentprime.io/advisories/CVE-2026-114349.md)
  `CVE-2026-114349` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-1284
- [Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs](https://agentprime.io/advisories/CVE-2026-112375.md)
  `CVE-2026-112375` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint](https://agentprime.io/advisories/CVE-2026-116593.md)
  `CVE-2026-116593` · CVE record: Apache Software Foundation Apache Kafka · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions](https://agentprime.io/advisories/CVE-2026-115644.md)
  `CVE-2026-115644` · CVE record: Apache Software Foundation Apache Kafka · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation](https://agentprime.io/advisories/CVE-2026-111551.md)
  `CVE-2026-111551` · CVE record: Apache Software Foundation Apache Kafka · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-20
- [Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation](https://agentprime.io/advisories/CVE-2026-111496.md)
  `CVE-2026-111496` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption, Denial of service
- [Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing](https://agentprime.io/advisories/CVE-2026-111115.md)
  `CVE-2026-111115` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026
- [Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers](https://agentprime.io/advisories/CVE-2026-111108.md)
  `CVE-2026-111108` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service](https://agentprime.io/advisories/CVE-2026-111073.md)
  `CVE-2026-111073` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-409
- [Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured](https://agentprime.io/advisories/CVE-2026-110985.md)
  `CVE-2026-110985` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Weak cryptography or TLS, CWE-345, CWE-636, CWE-1287
- [Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default](https://agentprime.io/advisories/CVE-2026-110952.md)
  `CVE-2026-110952` · CVE record: Apache Software Foundation Apache Kafka · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-345, CWE-1188
- [Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.](https://agentprime.io/advisories/CVE-2026-83525.md)
  `CVE-2026-83525` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-480
- [Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API](https://agentprime.io/advisories/CVE-2026-41115.md)
  `CVE-2026-41115` · CVE record: Apache Software Foundation Apache Kafka · CVSS 4.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-kafka>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-kafka/>. Everything for agents: <https://agentprime.io/llms.txt>.