CVE Tools
Track your stack

Apache Kafka

30 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Apache Kafka, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Kafka CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Kafka CVEs per month
MonthCVEs
2024-121
2025-010
2025-020
2025-030
2025-040
2025-050
2025-063
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-043
2026-050
2026-061
2026-070
2026-080
2026-090
2026-1012
2026-110

Severity

How the 30 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical517%
  • High1137%
  • Medium1447%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Kafka.

  1. CVE-2026-114349Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches6.5
  2. CVE-2026-112375Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs6.5
  3. CVE-2026-116593Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint8.1
  4. CVE-2026-115644Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions8.8
  5. CVE-2026-111551Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation7.5
  6. CVE-2026-111496Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation9.1
  7. CVE-2026-111115Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing9.1
  8. CVE-2026-111108Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers9.1
  9. CVE-2026-111073Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service6.5
  10. CVE-2026-110985Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured9.1
  11. CVE-2026-110952Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default5.9
  12. CVE-2026-83525Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.6.5
  13. CVE-2026-41115Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API4.3
  14. CVE-2026-33557Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication9.1
  15. CVE-2026-33558Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output5.3

Product grouping is registry-driven, with AI assist and human review. How it works