Most recent entries from all

bdu:2025-08199

BIT-kafka-2025-27819 — Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration

Affected: Bitnami: kafka

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.

Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

EUVD-2026-243650

fkie_cve-2025-27819

GHSA-mcwh-c9pg-xw43 — Apache Kafka Deserialization of Untrusted Data vulnerability

Affected: Maven: org.apache.kafka:kafka_2.10, Maven: org.apache.kafka:kafka_2.11, Maven: org.apache.kafka:kafka_2.12, Maven: org.apache.kafka:kafka_2.13, Maven: org.apache.kafka:kafka_2.8.0, Maven: org.apache.kafka:kafka_2.8.2, Maven: org.apache.kafka:kafka_2.9.1, Maven: org.apache.kafka:kafka_2.9.2

RHSA-2025:23417 — Red Hat Security Advisory: Streams for Apache Kafka 3.1.0 release and security update

kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout io.vertx/vertx-core: Eclipse Vert.x Access Control Flaw io.vertx/vertx-web: Eclipse Vert.x cross site scripting org.apache.kafka: Kafka Client Arbitrary File Read SSRF apache-kafka: Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang io.quarkus/quarkus-vertx: Quarkus potential data leak netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

WID-SEC-W-2025-1269 — Apache Kafka: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial-of-Service auszulösen.