[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMRDsrds0H481w7sEqPqJwGxlgAaMGTbFRM9_I4k1dH4":3,"g5a-ex:apache\u002Fkafka@*":340,"g5a-family:apache\u002Fkafka":342},{"success":4,"data":5},true,{"product":6,"versions":179,"topVulnerabilitiesByEpss":261,"kevVulnerabilities":317,"seoMetadata":318,"meta":337},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":178},"apache","kafka",81,8,0,"2024-04-12",[14,17,19,21,23,25,27,29,31,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,64,66,68,70,72,74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106,108,110,112,114,116,118,120,122,124,126,128,130,132,134,136,138,140,142,144,146,148,150,152,154,156,158,160,162,164,166,168,170,172,174,176],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},"0.10.0.0",false,{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},"0.10.0.1",{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},"0.10.1.0",{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},"0.10.1.1",{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},"0.10.2.0",{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},"0.10.2.1",{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},"0.10.2.2",{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},"0.11.0.0",{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},"0.11.0.1",{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},"0.11.0.2",{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},"0.11.0.3",{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},"0.7.0",{"version":40,"cve_count":11,"kev_count":11,"has_kev":16},"0.7.1",{"version":42,"cve_count":11,"kev_count":11,"has_kev":16},"0.7.2",{"version":44,"cve_count":11,"kev_count":11,"has_kev":16},"0.8.0",{"version":46,"cve_count":11,"kev_count":11,"has_kev":16},"0.8.0.2",{"version":48,"cve_count":11,"kev_count":11,"has_kev":16},"0.8.1",{"version":50,"cve_count":11,"kev_count":11,"has_kev":16},"0.8.1.1",{"version":52,"cve_count":11,"kev_count":11,"has_kev":16},"0.8.2",{"version":54,"cve_count":11,"kev_count":11,"has_kev":16},"0.8.2.0",{"version":56,"cve_count":11,"kev_count":11,"has_kev":16},"0.8.2.2",{"version":58,"cve_count":11,"kev_count":11,"has_kev":16},"0.9.0.0",{"version":60,"cve_count":11,"kev_count":11,"has_kev":16},"0.9.0.1",{"version":62,"cve_count":63,"kev_count":11,"has_kev":16},"1.0.0",1,{"version":65,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.1",{"version":67,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.2",{"version":69,"cve_count":11,"kev_count":11,"has_kev":16},"1.1.0",{"version":71,"cve_count":11,"kev_count":11,"has_kev":16},"1.1.1",{"version":73,"cve_count":63,"kev_count":11,"has_kev":16},"2.0.0",{"version":75,"cve_count":63,"kev_count":11,"has_kev":16},"2.0.1",{"version":77,"cve_count":11,"kev_count":11,"has_kev":16},"2.0.2",{"version":79,"cve_count":63,"kev_count":11,"has_kev":16},"2.1.0",{"version":81,"cve_count":63,"kev_count":11,"has_kev":16},"2.1.1",{"version":83,"cve_count":11,"kev_count":11,"has_kev":16},"2.1.2",{"version":85,"cve_count":63,"kev_count":11,"has_kev":16},"2.2.0",{"version":87,"cve_count":63,"kev_count":11,"has_kev":16},"2.2.1",{"version":89,"cve_count":11,"kev_count":11,"has_kev":16},"2.2.2",{"version":91,"cve_count":63,"kev_count":11,"has_kev":16},"2.3.0",{"version":93,"cve_count":11,"kev_count":11,"has_kev":16},"2.3.1",{"version":95,"cve_count":11,"kev_count":11,"has_kev":16},"2.4.0",{"version":97,"cve_count":11,"kev_count":11,"has_kev":16},"2.4.1",{"version":99,"cve_count":11,"kev_count":11,"has_kev":16},"2.5.0",{"version":101,"cve_count":11,"kev_count":11,"has_kev":16},"2.5.1",{"version":103,"cve_count":11,"kev_count":11,"has_kev":16},"2.6.0",{"version":105,"cve_count":11,"kev_count":11,"has_kev":16},"2.6.1",{"version":107,"cve_count":11,"kev_count":11,"has_kev":16},"2.6.2",{"version":109,"cve_count":11,"kev_count":11,"has_kev":16},"2.6.3",{"version":111,"cve_count":63,"kev_count":11,"has_kev":16},"2.7.0",{"version":113,"cve_count":11,"kev_count":11,"has_kev":16},"2.7.1",{"version":115,"cve_count":11,"kev_count":11,"has_kev":16},"2.7.2",{"version":117,"cve_count":63,"kev_count":11,"has_kev":16},"2.8.0",{"version":119,"cve_count":11,"kev_count":11,"has_kev":16},"2.8.1",{"version":121,"cve_count":11,"kev_count":11,"has_kev":16},"3.0.0",{"version":123,"cve_count":11,"kev_count":11,"has_kev":16},"3.0.1",{"version":125,"cve_count":11,"kev_count":11,"has_kev":16},"3.0.2",{"version":127,"cve_count":11,"kev_count":11,"has_kev":16},"3.1.0",{"version":129,"cve_count":11,"kev_count":11,"has_kev":16},"3.1.1",{"version":131,"cve_count":11,"kev_count":11,"has_kev":16},"3.1.2",{"version":133,"cve_count":11,"kev_count":11,"has_kev":16},"3.2.0",{"version":135,"cve_count":11,"kev_count":11,"has_kev":16},"3.2.1",{"version":137,"cve_count":11,"kev_count":11,"has_kev":16},"3.2.2",{"version":139,"cve_count":11,"kev_count":11,"has_kev":16},"3.2.3",{"version":141,"cve_count":11,"kev_count":11,"has_kev":16},"3.3.0",{"version":143,"cve_count":11,"kev_count":11,"has_kev":16},"3.3.1",{"version":145,"cve_count":11,"kev_count":11,"has_kev":16},"3.3.2",{"version":147,"cve_count":11,"kev_count":11,"has_kev":16},"3.4.0",{"version":149,"cve_count":11,"kev_count":11,"has_kev":16},"3.4.1",{"version":151,"cve_count":11,"kev_count":11,"has_kev":16},"3.5.0",{"version":153,"cve_count":11,"kev_count":11,"has_kev":16},"3.5.1",{"version":155,"cve_count":11,"kev_count":11,"has_kev":16},"3.5.2",{"version":157,"cve_count":11,"kev_count":11,"has_kev":16},"3.6.0",{"version":159,"cve_count":11,"kev_count":11,"has_kev":16},"3.6.1",{"version":161,"cve_count":11,"kev_count":11,"has_kev":16},"3.6.2",{"version":163,"cve_count":11,"kev_count":11,"has_kev":16},"3.7.0",{"version":165,"cve_count":11,"kev_count":11,"has_kev":16},"3.7.1",{"version":167,"cve_count":11,"kev_count":11,"has_kev":16},"3.7.2",{"version":169,"cve_count":11,"kev_count":11,"has_kev":16},"3.8.0",{"version":171,"cve_count":11,"kev_count":11,"has_kev":16},"3.8.1",{"version":173,"cve_count":11,"kev_count":11,"has_kev":16},"3.9.0",{"version":175,"cve_count":11,"kev_count":11,"has_kev":16},"3.9.1",{"version":177,"cve_count":11,"kev_count":11,"has_kev":16},"4.0.0","Kafka by Apache is a technology product with 81 tracked versions and 8 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},{"version":40,"cve_count":11,"kev_count":11,"has_kev":16},{"version":42,"cve_count":11,"kev_count":11,"has_kev":16},{"version":44,"cve_count":11,"kev_count":11,"has_kev":16},{"version":46,"cve_count":11,"kev_count":11,"has_kev":16},{"version":48,"cve_count":11,"kev_count":11,"has_kev":16},{"version":50,"cve_count":11,"kev_count":11,"has_kev":16},{"version":52,"cve_count":11,"kev_count":11,"has_kev":16},{"version":54,"cve_count":11,"kev_count":11,"has_kev":16},{"version":56,"cve_count":11,"kev_count":11,"has_kev":16},{"version":58,"cve_count":11,"kev_count":11,"has_kev":16},{"version":60,"cve_count":11,"kev_count":11,"has_kev":16},{"version":62,"cve_count":63,"kev_count":11,"has_kev":16},{"version":65,"cve_count":11,"kev_count":11,"has_kev":16},{"version":67,"cve_count":11,"kev_count":11,"has_kev":16},{"version":69,"cve_count":11,"kev_count":11,"has_kev":16},{"version":71,"cve_count":11,"kev_count":11,"has_kev":16},{"version":73,"cve_count":63,"kev_count":11,"has_kev":16},{"version":75,"cve_count":63,"kev_count":11,"has_kev":16},{"version":77,"cve_count":11,"kev_count":11,"has_kev":16},{"version":79,"cve_count":63,"kev_count":11,"has_kev":16},{"version":81,"cve_count":63,"kev_count":11,"has_kev":16},{"version":83,"cve_count":11,"kev_count":11,"has_kev":16},{"version":85,"cve_count":63,"kev_count":11,"has_kev":16},{"version":87,"cve_count":63,"kev_count":11,"has_kev":16},{"version":89,"cve_count":11,"kev_count":11,"has_kev":16},{"version":91,"cve_count":63,"kev_count":11,"has_kev":16},{"version":93,"cve_count":11,"kev_count":11,"has_kev":16},{"version":95,"cve_count":11,"kev_count":11,"has_kev":16},{"version":97,"cve_count":11,"kev_count":11,"has_kev":16},{"version":99,"cve_count":11,"kev_count":11,"has_kev":16},{"version":101,"cve_count":11,"kev_count":11,"has_kev":16},{"version":103,"cve_count":11,"kev_count":11,"has_kev":16},{"version":105,"cve_count":11,"kev_count":11,"has_kev":16},{"version":107,"cve_count":11,"kev_count":11,"has_kev":16},{"version":109,"cve_count":11,"kev_count":11,"has_kev":16},{"version":111,"cve_count":63,"kev_count":11,"has_kev":16},{"version":113,"cve_count":11,"kev_count":11,"has_kev":16},{"version":115,"cve_count":11,"kev_count":11,"has_kev":16},{"version":117,"cve_count":63,"kev_count":11,"has_kev":16},{"version":119,"cve_count":11,"kev_count":11,"has_kev":16},{"version":121,"cve_count":11,"kev_count":11,"has_kev":16},{"version":123,"cve_count":11,"kev_count":11,"has_kev":16},{"version":125,"cve_count":11,"kev_count":11,"has_kev":16},{"version":127,"cve_count":11,"kev_count":11,"has_kev":16},{"version":129,"cve_count":11,"kev_count":11,"has_kev":16},{"version":131,"cve_count":11,"kev_count":11,"has_kev":16},{"version":133,"cve_count":11,"kev_count":11,"has_kev":16},{"version":135,"cve_count":11,"kev_count":11,"has_kev":16},{"version":137,"cve_count":11,"kev_count":11,"has_kev":16},{"version":139,"cve_count":11,"kev_count":11,"has_kev":16},{"version":141,"cve_count":11,"kev_count":11,"has_kev":16},{"version":143,"cve_count":11,"kev_count":11,"has_kev":16},{"version":145,"cve_count":11,"kev_count":11,"has_kev":16},{"version":147,"cve_count":11,"kev_count":11,"has_kev":16},{"version":149,"cve_count":11,"kev_count":11,"has_kev":16},{"version":151,"cve_count":11,"kev_count":11,"has_kev":16},{"version":153,"cve_count":11,"kev_count":11,"has_kev":16},{"version":155,"cve_count":11,"kev_count":11,"has_kev":16},{"version":157,"cve_count":11,"kev_count":11,"has_kev":16},{"version":159,"cve_count":11,"kev_count":11,"has_kev":16},{"version":161,"cve_count":11,"kev_count":11,"has_kev":16},{"version":163,"cve_count":11,"kev_count":11,"has_kev":16},{"version":165,"cve_count":11,"kev_count":11,"has_kev":16},{"version":167,"cve_count":11,"kev_count":11,"has_kev":16},{"version":169,"cve_count":11,"kev_count":11,"has_kev":16},{"version":171,"cve_count":11,"kev_count":11,"has_kev":16},{"version":173,"cve_count":11,"kev_count":11,"has_kev":16},{"version":175,"cve_count":11,"kev_count":11,"has_kev":16},{"version":177,"cve_count":11,"kev_count":11,"has_kev":16},[262,270,276,284,290,296,301,306,311],{"cveId":263,"description":264,"publishedDate":265,"cvssScore":266,"cvssVersion":267,"severity":268,"isKev":16,"epssScore":269},"CVE-2020-27218","In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.","2020-11-28",4.8,"v3.1","Medium",0.08277,{"cveId":271,"description":272,"publishedDate":273,"cvssScore":274,"cvssVersion":267,"severity":268,"isKev":16,"epssScore":275},"CVE-2021-38153","Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.","2021-09-22",5.9,0.06201,{"cveId":277,"description":278,"publishedDate":279,"cvssScore":280,"cvssVersion":281,"severity":282,"isKev":16,"epssScore":283},"CVE-2018-17196","In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction\u002Fidempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.","2019-07-11",8.8,"v3.0","High",0.05479,{"cveId":285,"description":286,"publishedDate":287,"cvssScore":288,"cvssVersion":267,"severity":268,"isKev":16,"epssScore":289},"CVE-2018-1288","In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","2018-07-26",5.4,0.04801,{"cveId":291,"description":292,"publishedDate":293,"cvssScore":294,"cvssVersion":267,"severity":282,"isKev":16,"epssScore":295},"CVE-2019-12399","When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created\u002Fupdated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.","2020-01-14",7.5,0.03915,{"cveId":297,"description":298,"publishedDate":287,"cvssScore":299,"cvssVersion":281,"severity":268,"isKev":16,"epssScore":300},"CVE-2017-12610","In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL\u002FPLAIN or SASL\u002FSCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.",6.8,0.02872,{"cveId":302,"description":303,"publishedDate":304,"cvssScore":294,"cvssVersion":267,"severity":282,"isKev":16,"epssScore":305},"CVE-2022-34917","A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.","2022-09-20",0.01495,{"cveId":307,"description":308,"publishedDate":12,"cvssScore":309,"cvssVersion":267,"severity":282,"isKev":16,"epssScore":310},"CVE-2024-27309","While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.\n\nTwo preconditions are needed to trigger the bug:\n1. The administrator decides to remove an ACL\n2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.\n\nWhen those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.\n\nThe incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).\n\nThe full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.",7.4,0.01125,{"cveId":312,"description":313,"publishedDate":314,"cvssScore":315,"cvssVersion":267,"severity":268,"isKev":16,"epssScore":316},"CVE-2026-41115","An improper authorization vulnerability has been identified in Apache Kafka.\n\nThe implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join\u002Fsync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.\n\nThe correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.","2026-06-02",4.3,0.00454,[],{"title":319,"metaDescription":320,"keywords":321,"structuredData":322},"Kafka by Apache - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Kafka by Apache covering 81 versions with 8 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Kafka vulnerabilities, Kafka security, Kafka CVE, Apache Kafka, Kafka threat intelligence, Apache security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":323,"@type":324,"name":325,"description":320,"url":326,"manufacturer":327,"applicationCategory":331,"softwareVersion":332,"mainEntity":333},"https:\u002F\u002Fschema.org","SoftwareApplication","Kafka","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fapache\u002Fkafka",{"@type":328,"name":329,"url":330},"Organization","Apache","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fapache","Security Software","81 versions tracked",{"@type":334,"name":335,"description":336,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Kafka Security Vulnerabilities","Security vulnerabilities affecting Kafka by Apache",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":338,"apiVersion":339},"2026-10-17T13:25:15.982Z","3.0",{"rows":341,"total":11,"capped":16,"failed":11},[],[343],{"product":344,"cves":63},"kafka_connect"]