Advisories · Technology

Apache Software Foundation Apache Kafka.

Every CVE that names Apache Software Foundation Apache Kafka among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-114349 CVE record

CVSS 6.5 Medium

Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
- Apache Software Foundation Apache Kafka
- Denial of service
- CWE-1284
Not analysed yet 28 Oct 2026
CVE-2026-112375 CVE record

CVSS 6.5 Medium

Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
- Apache Software Foundation Apache Kafka
- Broken access control
Not analysed yet 28 Oct 2026
CVE-2026-116593 CVE record

CVSS 8.1 High

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
- Apache Software Foundation Apache Kafka
- Information disclosure
Not analysed yet 28 Oct 2026
CVE-2026-115644 CVE record

CVSS 8.8 High

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
- Apache Software Foundation Apache Kafka
- Authentication bypass
Not analysed yet 28 Oct 2026
CVE-2026-111551 CVE record

CVSS 7.5 High

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
- Apache Software Foundation Apache Kafka
- Denial of service
- CWE-20
Not analysed yet 28 Oct 2026
CVE-2026-111496 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
- Apache Software Foundation Apache Kafka
- Memory corruption
- Denial of service
Not analysed yet 28 Oct 2026
CVE-2026-111115 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
- Apache Software Foundation Apache Kafka
Not analysed yet 28 Oct 2026
CVE-2026-111108 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
- Apache Software Foundation Apache Kafka
- Denial of service
Not analysed yet 28 Oct 2026
CVE-2026-111073 CVE record

CVSS 6.5 Medium

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
- Apache Software Foundation Apache Kafka
- Denial of service
- CWE-409
Not analysed yet 28 Oct 2026
CVE-2026-110985 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
- Apache Software Foundation Apache Kafka
- Weak cryptography or TLS
- CWE-345
Not analysed yet 28 Oct 2026
CVE-2026-110952 CVE record

CVSS 5.9 Medium

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
- Apache Software Foundation Apache Kafka
- CWE-345
- CWE-1188
Not analysed yet 28 Oct 2026
CVE-2026-83525 CVE record

CVSS 6.5 Medium

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
- Apache Software Foundation Apache Kafka
- CWE-480
Not analysed yet 28 Oct 2026
CVE-2026-41115 CVE record

CVSS 4.3 Medium

Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
- Apache Software Foundation Apache Kafka
- Broken access control
Not analysed yet 2 Jun 2026