org.apache.kafka:kafka_2.10

2 results · Feed

• High 7.5
  CVE-2025-27819

  Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration

  In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit t…

  Apache Software Foundation Apache Kafka org.apache.kafka:kafka_2.12 org.apache.kafka:kafka_2.11 Maven
  Jun 10, 2025
• Medium 5.3
  CVE-2024-56128

  Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

  Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1…

  Apache Software Foundation Apache Kafka strimzi-kafka-operator-kafka-thirdparty-libs-cc strimzi-kafka-operator-kafka-agent Wolfi Maven
  Dec 18, 2024