Skip to content
OpenAdvisories
Medium WID-SEC-2026-4221 13 CVEs

Apache Kafka: Mehrere Schwachstellen

Published Oct 28, 2026 · Updated Oct 28, 2026 · de-DE

Vendor: Apache Product: Kafka Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.

Product

Apache Kafka ist eine verteilte Streaming-Plattform mit einer Publish-Subcribe-Architektur (Pub-Sub).

Vulnerabilities 13

  • Critical 9.1
    CVE-2026-110985

    Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

    A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • Critical 9.1
    CVE-2026-111108

    Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

    Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most e…

    Apache Software Foundation Apache Kafka
  • Critical 9.1
    CVE-2026-111115

    Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

    Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size (socket.request.max.by…

    Apache Software Foundation Apache Kafka
  • Critical 9.1
    CVE-2026-111496

    Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

    Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advan…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • High 8.8
    CVE-2026-115644

    Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

    Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • High 8.7
    CVE-2026-102479

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canoni…

    Eclipse Foundation Eclipse Vert.x
  • High 8.1
    CVE-2026-116593

    Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

    Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuratio…

    Apache Software Foundation Apache Kafka
  • High 7.5
    CVE-2026-111551

    Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

    Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large s…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • Medium 6.5
    CVE-2026-111073

    Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

    The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on t…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • Medium 6.5
    CVE-2026-112375

    Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

    An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs (or AlterConfigs) request targeting a BROK…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • Medium 6.5
    CVE-2026-114349

    Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches

    When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • Medium 6.5
    CVE-2026-83525

    Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

    Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process…

    Apache Software Foundation Apache Kafka kafka Ubuntu
  • Medium 5.9
    CVE-2026-110952

    Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

    A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer (iss) claim is verified only when sas…

    Apache Software Foundation Apache Kafka kafka Ubuntu

Revision history

  1. #1

    Initiale Fassung

References