SF
Product
Streams for Apache Kafka 2.9.4
10
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 2High 8Medium 0Low 0
Watch
Add Streams for Apache Kafka 2.9.4 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47691 | 10.0 | Jun 12 | Netty has Insufficient Bailiwick Validation for NS Records Affected: All versions, or not specified |
| CVE-2026-45674 | 10.0 | Jun 12 | Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records Affected: All versions, or not specified |
| CVE-2026-39852 | 8.2 | May 5 | Quarkus authorization bypass via semicolon path normalization inconsistency Affected: All versions, or not specified |
| CVE-2026-50559 | 7.5 | Jun 19 | Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities Affected: All versions, or not specified |
| CVE-2026-48059 | 7.5 | Jun 12 | Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion Affected: All versions, or not specified |
| CVE-2026-48043 | 7.5 | Jun 12 | netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion Affected: All versions, or not specified |
| CVE-2026-44893 | 7.5 | Jun 12 | Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length Affected: All versions, or not specified |
| CVE-2026-42587 | 7.5 | May 13 | Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS Affected: All versions, or not specified |
| CVE-2026-33871 | 7.5 | Mar 27 | Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass Affected: All versions, or not specified |
| CVE-2026-33870 | 7.5 | Mar 27 | Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Affected: All versions, or not specified |
Showing 10
