Streams for apache kafka

This hub aggregates every CVE we track for Streams for apache kafka, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Streams for apache kafka.

• CVE-2026-32281Inefficient policy validation in crypto/x5097.5Apr 8, 2026
• CVE-2026-32280Unexpected work during chain building in crypto/x5097.5Apr 8, 2026
• CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5Apr 8, 2026
• CVE-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix6.4Apr 8, 2026
• CVE-2026-27903minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments7.5Feb 26, 2026
• CVE-2024-4027Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks7.5Jan 30, 2026
• CVE-2024-3884Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded7.5Dec 3, 2025
• CVE-2025-58457Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands4.3Sep 24, 2025
• CVE-2025-58057Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack7.5Sep 3, 2025
• CVE-2025-48734Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default8.8May 28, 2025
• CVE-2024-13009Eclipse Jetty GZIP buffer release7.2May 8, 2025
• CVE-2024-12397Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling7.4Dec 12, 2024
• CVE-2023-1932Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss6.1Nov 7, 2024
• CVE-2024-8285Kroxylicious: missing upstream kafka tls hostname verification5.9Aug 30, 2024
• CVE-2024-3653Undertow: learningpushhandler can lead to remote memory dos attacks5.3Jul 8, 2024