What’s Vulnerable › Products

Apache Kafka vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.

Check whether your Apache Kafka version is affected

Latest Apache Kafka vulnerabilities

• CVE-2026-114349 — Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
• CVE-2026-112375 — Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
• CVE-2026-116593 — Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
• CVE-2026-115644 — Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
• CVE-2026-111551 — Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
• CVE-2026-111496 — Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
• CVE-2026-111115 — Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
• CVE-2026-111108 — Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
• CVE-2026-111073 — Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
• CVE-2026-110985 — Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
• CVE-2026-110952 — Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
• CVE-2026-83525 — Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
• CVE-2026-41115 — Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API (CVSS 4.3)
• CVE-2026-33558 — Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output (CVSS 5.3)
• CVE-2026-33557 — Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication (CVSS 9.1)
• CVE-2026-35554 — Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition (CVSS 8.7)
• CVE-2025-27819 — Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration (CVSS 7.5)
• CVE-2025-27818 — Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration (CVSS 8.8)
• CVE-2025-27817 — Apache Kafka Client: Arbitrary file read and SSRF vulnerability (CVSS 7.5)
• CVE-2024-56128 — Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption (CVSS 5.3)
• CVE-2024-31141 — Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider (CVSS 6.5)
• CVE-2024-27309 — Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode (CVSS 7.4)
• CVE-2022-34917 — Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers (CVSS 7.5)
• CVE-2021-38153 — Timing Attack Vulnerability for Apache Kafka Connect and Clients (CVSS 5.9)
• CVE-2020-27218 — (CVSS 4.8)