415 matches found
CVE-2025-27817
Disclaimer: The vulnerabilities and reproduction steps described in this document are for cybersecurity research and educational purposes only. No one may use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no liability for any...
Apache Kafka Client - Arbitrary File Read
Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...
kafka-keycloak-oauth
Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Production-ready Apache Kafka 4.1.0 KRaft mode with Keycloak 26.1.1 OAuth2/OIDC authentication using Strimzi Kafka image. Why This Project vs kafka-oauth-keycloak-tls-demo This is an evolution of the previous POC with significant improvements...
GHSA-6QM2-MCQ7-53QP vulnerabilities
Vulnerabilities for packages: cassandra, infinispan, scala, nacos, confluent-kafka, localstack, cass-config-builder, wso2is, s3proxy-fips, apache-activemq-fips, zookeeper, apache-pulsar, logstash, apache-tika-fips, solr, conductor-fips, nextflow, flyway-fips, opensearch-fips, spdx-tools-java,...
Security Bulletin: Security Vulnerability in Apache Kafka affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-35554, CVE-2026-33558)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the vulnerability. Vulnerability Details CVEID:CVE-2026-33558 DESCRIPTION: Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses...
CVE-2026-59278
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...
CVE-2026-59317
CVE-2026-59317...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services Enterprise modules. These vulnerabilities exist in third-party products such as Apache Kafka, Log4j, and the Spring Framework. Updates have been released by the developers for these products. These updates are now integrated into...
CLEANSTART-2026-KQ29054 Security fixes in confluent-kafka 8.3.0-r1
Package confluent-kafka version 8.3.0-r1 fixes 14 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54516, CVE-2026-54517...
Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management
A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer...
Important: Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update
Streams for Apache Kafka 3.2.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2026-41115
A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMERGROUPDESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists ACLs,...
Photon OS 5.0: Kafka PHSA-2026-5.0-91-0855
An update of the kafka package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0855. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CLSA-2026-1783991065 TuxCare security update for org.apache.kafka (2 CVEs)
TuxCare rebuilt 56 org.apache.kafka packages to address 2 CVEs. Fixed in 3.7.1-tuxcare.1...
CLSA-2025-1752019395 TuxCare security update for org.apache.kafka (5 CVEs)
TuxCare rebuilt 47 org.apache.kafka packages to address 5 CVEs. Fixed in 3.2.3.tuxcare.1...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...
Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management
A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer...
Important: Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update
Streams for Apache Kafka 2.9.4 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ROS-20260629-73-0023
The vulnerability of the Apache Kafka message dispatcher is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...
ROS-20260625-73-0022
The vulnerability in Apache Kafka is related to incorrect checking of the specified index, position, or offset in the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...