Linux Distros Unpatched Vulnerability : CVE-2021-38153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such...

Linux Distros Unpatched Vulnerability : CVE-2024-27309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are need...

Linux Distros Unpatched Vulnerability : CVE-2022-4344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted captur...

Malicious code in kafka-shopify (npm)

The package kafka-shopify was found to contain malicious code...

MAL-2025-24159 Malicious code in kafka-shopify (npm)

The package kafka-shopify was found to contain malicious code...

Malicious code in ruby-kafka-oauth-client (npm)

The package ruby-kafka-oauth-client was found to contain malicious code...

MAL-2025-24158 Malicious code in kafka-client-ruby (npm)

The package kafka-client-ruby was found to contain malicious code...

MAL-2025-32531 Malicious code in ruby-kafka-oauth-client (npm)

The package ruby-kafka-oauth-client was found to contain malicious code...

Malicious code in kafka-client-ruby (npm)

The package kafka-client-ruby was found to contain malicious code...

Malicious code in hapi-kafka-node (npm)

The package hapi-kafka-node was found to contain malicious code...

MAL-2025-22181 Malicious code in hapi-kafka-node (npm)

The package hapi-kafka-node was found to contain malicious code...

MAL-2025-23223 Malicious code in infra-kafka-agent (npm)

The package infra-kafka-agent was found to contain malicious code...

Security Bulletin: Kafka client library upgraded to kafka-clients-3.9.1

Summary Kafka client library upgraded to kafka-clients-3.9.1. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: go-md2man, snyk-cli, esbuild, gosu, dive, newrelic-fluent-bit-output, cargobump, kube-rbac-proxy, configmap-reload, gomplate, nri-mysql, yunikorn-k8shim, spire-server, crossplane-provider-azure-managedidentity, kube-metrics-adapter, witness, rancher-loglevel, conftes...

Security Bulletin: Multiple vulnerabilities in embedded Navigator affect IBM Business Automation Workflow - CVE-2024-38808, CVE-2024-31141

Summary IBM Business Automation Workflow repackages a version of IBM Content Navigator, which in turn repackages a vulnerable version of the kafka-clients library. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to External Parties, Improper Privilege...

Security Bulletin: There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-27817)

Summary There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-27817 DESCRIPTION: A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka...

ROS-20250804-02

A vulnerability in Apache Kafka Message Manager is related to flaws in the deserialization mechanism. Exploitation of the vulnerability could allow an attacker acting remotely to execute remote code Vulnerability in sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url client...

kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

A flaw was found in Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM, which did not fully adhere to the requirements of RFC 5802. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the...

Important: Red Hat Security Advisory: Streams for Apache Kafka 3.0.0 release and security update

Streams for Apache Kafka 3.0.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider

A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider...