Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.kafka:kafka-clients

8 known vulnerabilities (1 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
4.4.0 (Oct 6, 2026): no advisory affects it
Newest unaffected release
4.4.0 (Oct 6, 2026), the latest release
Advisories
8 · 1 critical, 3 high, 2 medium
Dependents
277
Releases
87 since 0.8.2.0 (Jan 29, 2015)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-111551
    Affects 0.10.0.0 to 4.2.1 (4.2.2 is outside it); 4.3.0 to 4.3.1 (4.3.2 is outside it)
  • CVE-2026-33557
    Affects 4.1.0 to 4.1.1 (4.1.2 is outside it)
  • CVE-2026-33558
    Affects 0.11.0.0 to 3.9.1 (3.9.2 is outside it); 4.0.0 (4.0.1 is outside it)
  • CVE-2026-35554
    Affects 2.8.0 to 3.9.1 (3.9.2 is outside it); 4.0.0 to 4.0.1 (4.0.2 is outside it); 4.1.0 to 4.1.1 (4.1.2 is outside it)
  • CVE-2025-27817
    Affects 3.1.0 to 3.9.0 (3.9.1 is outside it)
  • CVE-2024-31141
    Affects 2.3.0 to 3.7.0 (3.7.1 is outside it)
  • CVE-2021-38153
    Affects 2.0.0 to 2.6.2 (2.6.3 is outside it); 2.7.0 to 2.7.1 (2.7.2 is outside it); 2.8.0 (2.8.1 is outside it)
  • CVE-2017-12610
    Affects 0.10.0.0 to 0.10.2.1 (0.10.2.2 is outside it); 0.11.0.0 to 0.11.0.1 (0.11.0.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

    Affected: from 0.10.0.0, through 4.1.2; from 4.2.0, through 4.2.1; from 4.3.0, through 4.3.1.

    Fixed in 4.3.2 (released Oct 11, 2026, 17 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 4.4.0, is not affected.

  • CVE-2026-33557Critical 9.1

    Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

    Affected: from 4.1.0, fixed in 4.1.2.

    Fixed in 4.1.2 (released Feb 24, 2026, 55 days before disclosure).

    The latest release, 4.4.0, is not affected.

  • CVE-2026-33558Medium 5.3

    Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output

    Affected: from 0.11.0, through 3.9.1; from 0.11.0, fixed in 3.9.2; from 4.0.0, fixed in 4.0.1.

    Fixed in 3.9.2 (released Feb 7, 2026, 72 days before disclosure) and 4.0.1 (released Sep 9, 2025, 223 days before disclosure).

    The latest release, 4.4.0, is not affected.

  • Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

    Affected: from 2.8.0, through 3.9.1; from 4.0.0, through 4.0.1; from 4.1.0, through 4.1.1; from 2.8.0, fixed in 3.9.2; from 4.0.0, fixed in 4.0.2; from 4.1.0, fixed in 4.1.2.

    Fixed in 3.9.2 (released Feb 7, 2026, 59 days before disclosure), 4.0.2 (released Mar 3, 2026, 35 days before disclosure) and 4.1.2 (released Feb 24, 2026, 42 days before disclosure).

    The latest release, 4.4.0, is not affected.

  • Apache Kafka Client: Arbitrary file read and SSRF vulnerability

    Affected: from 3.1.0, fixed in 3.9.1.

    Fixed in 3.9.1 (released May 12, 2025, 29 days before disclosure).

    The latest release, 4.4.0, is not affected.

  • CVE-2024-31141Medium 6.5

    Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

    Affected: from 2.3.0, through 3.5.2; from 3.6.0, through 3.6.2; from 2.3.0, fixed in 3.7.1.

    Fixed in 3.7.1 (released Jun 18, 2024, 154 days before disclosure).

    The latest release, 4.4.0, is not affected.

  • Timing Attack Vulnerability for Apache Kafka Connect and Clients

    Affected: from 2.0.0, fixed in 2.6.3; from 2.7.0, fixed in 2.7.2; from 2.8.0, fixed in 2.8.1.

    Fixed in 2.6.3 (released Oct 12, 2021, 20 days after disclosure), 2.7.2 (released Oct 12, 2021, 20 days after disclosure) and 2.8.1 (released Sep 14, 2021, 8 days before disclosure).

    The latest release, 4.4.0, is not affected.

  • In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted…

    Affected: from 0.10.0.0, fixed in 0.10.2.2; from 0.11.0.0, fixed in 0.11.0.2.

    Fixed in 0.10.2.2 (released Jun 23, 2018, 33 days before disclosure) and 0.11.0.2 (released Nov 10, 2017, 258 days before disclosure).

    The latest release, 4.4.0, is not affected.