# org.apache.kafka:kafka (Maven) vulnerabilities 10 known vulnerabilities (3 critical, 1 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.apache.kafka/kafka ## Advisories (10) ### [CVE-2026-112375](https://cve.now/CVE-2026-112375): Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs - Severity: Medium 6.5 - Published: Oct 28, 2026 - Affected: from 3.2.0, through 4.1.2; from 4.2.0, through 4.2.1; from 4.3.0, through 4.3.1. ### [CVE-2026-111115](https://cve.now/CVE-2026-111115): Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing - Severity: Critical 9.1 - Published: Oct 28, 2026 - Affected: from 2.4.0, through 4.1.2; from 4.2.0, through 4.2.1; from 4.3.0, through 4.3.1. ### [CVE-2026-111108](https://cve.now/CVE-2026-111108): Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers - Severity: Critical 9.1 - Published: Oct 28, 2026 - Affected: from 3.3.0, through 4.1.2; from 4.2.0, through 4.2.1; from 4.3.0, through 4.3.1. ### [CVE-2026-111073](https://cve.now/CVE-2026-111073): Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of… - Severity: Medium 6.5 - Published: Oct 28, 2026 - Affected: from 3.7.0, through 4.1.2; from 4.2.0, through 4.2.1. ### [CVE-2026-110985](https://cve.now/CVE-2026-110985): Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured - Severity: Critical 9.1 - Published: Oct 28, 2026 - Affected: from 4.1.0, through 4.1.2; from 4.2.0, through 4.2.1. ### [CVE-2026-110952](https://cve.now/CVE-2026-110952): Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default - Severity: Medium 5.9 - Published: Oct 28, 2026 - Affected: from 3.1.0, fixed in 4.4.0. ### [CVE-2022-34917](https://cve.now/CVE-2022-34917): Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers - Severity: High 7.5 - Published: Sep 20, 2022 - Affected: from 2.8.0, fixed in 2.8.2; from 3.0.0, fixed in 3.0.2; from 3.1.0, fixed in 3.1.2; from 3.2.0, fixed in 3.2.3. ### [CVE-2019-12399](https://cve.now/CVE-2019-12399): When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers… - Severity: Unrated - Published: Jan 14, 2020 - Affected: from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.2; from 2.2.0, fixed in 2.2.2; from 2.3.0, fixed in 2.3.1. ### [CVE-2018-17196](https://cve.now/CVE-2018-17196): In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses… - Severity: Unrated - Published: Jul 11, 2019 - Affected: from 0.11.0.0, fixed in 2.1.1. ### [CVE-2018-1288](https://cve.now/CVE-2018-1288): In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action… - Severity: Unrated - Published: Jul 26, 2018 - Affected: from 0.9.0.0, fixed in 0.10.2.2; from 0.11.0.0, fixed in 0.11.0.3; from 1.0.0, fixed in 1.0.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.kafka:kafka Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.