KA
Product
Kafka
17
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 8Medium 8Low 0
Watch
Add Kafka to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12610 | 6.8 | Jul 26 | In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or… Affected: 0.10.0.0 through 0.10.2.1; 0.11.0.0 through 0.11.0.1 |
| CVE-2024-31141 | 6.5 | Nov 19 | Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients Affected: 2.3.0 through 3.5.2; 3.6.0 through 3.6.2; 3.7.0 |
| CVE-2021-38153 | 5.9 | Sep 22 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more… Affected: 2.0.0 before 2.6.3; 2.7.0 before 2.7.2; 2.8.0 |
| CVE-2018-1288 | 5.4 | Jul 26 | In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually… Affected: after 0.9.0.0 through 0.9.0.1; 0.10.0.0 through 0.10.2.1; 0.11.0.0 through 0.11.0.2; 1.0.0 |
| CVE-2026-33558 | 5.3 | Apr 20 | Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output Affected: 0.11.0.0 before 3.9.2; 4.0.0; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2024-56128 | 5.3 | Dec 18 | Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption Affected: 0.10.2.0 before 3.7.2; 3.8.0 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 2.7.0 |
| CVE-2026-41115 | 4.3 | Jun 2 | Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API Affected: 4.0.0 through 4.3.0 |
Showing 8