unknown
CVE-2026-112375
Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
Apache Software Foundation · Apache Kafka
org.apache.kafka:kafka
Follow this packageGet the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.
Check the version you ship.
Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.
Advisories & recorded fixes
unknown
CVE-2026-111115
Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
Apache Software Foundation · Apache Kafka
unknown
CVE-2026-111108
Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
Apache Software Foundation · Apache Kafka
unknown
CVE-2026-111073
Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
Apache Software Foundation · Apache Kafka
unknown
CVE-2026-110985
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Apache Software Foundation · Apache Kafka
unknown
CVE-2026-110952
Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
Apache Software Foundation · Apache Kafka