1357 matches found
CVE-2026-33558
CVE-2026-33558 affects Apache Kafka: the NetworkClient logs sensitive information at DEBUG level, exposing full requests/responses for certain APIs (AlterConfigsRequest, AlterUserScramCredentialsRequest, ExpireDelegationTokenRequest, IncrementalAlterConfigsRequest, RenewDelegationTokenRequest, Sa...
CVE-2026-33558 Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information wi...
Apache Kafka 安全漏洞
Apache Kafka is an open-source distributed streaming platform developed by the Apache Foundation in the United States. This platform enables the acquisition of real-time data, allowing for the creation of applications that can respond in real time to changes in data streams. There are security...
Apache Kafka 安全漏洞
Apache Kafka is an open-source distributed streaming platform developed by the Apache Foundation in the United States. This platform enables the acquisition of real-time data, allowing for the creation of applications that can respond in real time to changes in data streams. Versions 4.1.0 and...
PT-2026-33644
Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 3.9.2 Apache Kafka versions prior to 4.0.1 Description The NetworkClient component outputs complete request and response information when the log level is set to DEBUG. While the default log level is INFO, enabli...
CVE-2026-35554 vulnerabilities
Vulnerabilities for packages: seata, debezium, opensearch, knative-kafka-broker, debezium-connector-spanner, debezium-connector-vitess, thingsboard, hono, debezium-connector-informix, strimzi-kafka-operator, strimzi-kafka-operator-fips, druid, logstash, wildfly, debezium-connector-db2, apache-nif...
GHSA-5QCV-4RPC-JP93 vulnerabilities
Vulnerabilities for packages: seata, debezium, opensearch, knative-kafka-broker, debezium-connector-spanner, debezium-connector-vitess, thingsboard, hono, debezium-connector-informix, strimzi-kafka-operator, strimzi-kafka-operator-fips, druid, logstash, wildfly, debezium-connector-db2, apache-nif...
PT-2026-33633
Name of the Vulnerable Software and Affected Versions Apache Kafka versions 4.1.0 through 4.1.1 Description An authentication bypass exists in Apache Kafka due to the default configuration of the sasl.oauthbearer.jwt.validator.class property, which is set to...
CVE-2026-34480 vulnerabilities
Vulnerabilities for packages: kafka-bridge, apache-pulsar, elasticsearch, spark-kubernetes-operator-fips, pinot, hadoop-fips, kafka-fips, celeborn, commercial-elasticsearch, opensearch, elasticsearch-fips, zipkin, apache-activemq, spark, tritonserver-backend-vllm-cuda-13.0, geoserver,...
GHSA-3PXV-7CMR-FJR4 vulnerabilities
Vulnerabilities for packages: kafka-bridge, apache-pulsar, elasticsearch, spark-kubernetes-operator-fips, pinot, hadoop-fips, kafka-fips, celeborn, commercial-elasticsearch, opensearch, elasticsearch-fips, zipkin, apache-activemq, spark, tritonserver-backend-vllm-cuda-13.0, geoserver,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: nfs-subdir-external-provisioner, request-1279-14, ip-masq-agent, syft, kubernetes-secret-generator, kbld, newrelic-infra-operator, grpcurl-fips, kuma, neuvector-scanner-fips, aws-nuke-fips, prometheus-adapter, gcp-compute-persistent-disk-csi-driver-fips, dex-fips,...
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to lz4 and Apache Log4j (CVE-2025-12183, CVE-2025-66566 & CVE-2025-68161 )
Summary Users of Kafka features in IBM App Connect Enterprise and IBM Integration Bus for z/OS and the jdbcConnector in IBM App Connect Enterprise are vulnerable to multiple vulnerabilities due to lz4 and Apache Log4j. Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory...
VulnCheck KEV: CVE-2025-27817
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url"...
Race Condition
Overview org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur. Affected versions of this package are vulnerable to Race Condition in...
EUVD-2026-19631
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...
GHSA-5QCV-4RPC-JP93 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...
CVE-2026-35554
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...
CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...
CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...
CVE-2026-35554
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...