4.3.1 Wed, Jun 17
4.3.1-rc2 Wed, Jun 17
4.3.1-rc1 Mon, Jun 15
4.3.1-rc0 Thu, Jun 11
4.2.1-rc5 Wed, May 13
4.2.1 Wed, May 13
4.3.0-rc2 Wed, May 13
4.3.0 Wed, May 13
4.2.1-rc4 Tue, May 12
4.3.0-rc1 Tue, May 5
4.3.0-rc0 Tue, Apr 28
4.2.1-rc3 Sat, Apr 25
4.2.1-rc2 Thu, Apr 23
4.2.1-rc1 Sat, Apr 18
4.2.1-rc0 Sat, Apr 11
4.0.2 Tue, Mar 3
4.0.2-rc3 Tue, Mar 3
4.1.2 Tue, Feb 24
4.1.2-rc1 Tue, Feb 24
4.1.2-rc0 Tue, Feb 24
HIGH CVE-2025-27818 Tue, Jun 10
A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0).
GHSA-76qp-h5mr-frr4
CVE-2025-27818
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
org.apache.kafka:kafka_2.11 introduced: 2.3.0 last_affected: 2.4.1
org.apache.kafka:kafka_2.12 introduced: 2.3.0 fixed: 3.9.1
org.apache.kafka:kafka_2.13 introduced: 2.4.0 fixed: 3.9.1
HIGH CVE-2025-27819 Tue, Jun 10
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
GHSA-mcwh-c9pg-xw43
CVE-2025-27819
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
org.apache.kafka:kafka_2.10 introduced: 0
org.apache.kafka:kafka_2.11 introduced: 0
org.apache.kafka:kafka_2.12 introduced: 0 fixed: 3.4.0
org.apache.kafka:kafka_2.13 introduced: 0 fixed: 3.4.0
org.apache.kafka:kafka_2.8.0 introduced: 0
org.apache.kafka:kafka_2.8.2 introduced: 0
… +2 more ranges
LOW CVE-2024-56128 Wed, Dec 18
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1]. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message.
GHSA-p7c9-8xx8-h74f
CVE-2024-56128
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
org.apache.kafka:kafka_2.13 introduced: 0.10.2.0 fixed: 3.7.2
org.apache.kafka:kafka_2.13 introduced: 3.8.0 fixed: 3.8.1
org.apache.kafka:kafka_2.12 introduced: 0.10.2.0 fixed: 3.7.2
org.apache.kafka:kafka_2.12 introduced: 3.8.0 fixed: 3.8.1
org.apache.kafka:kafka_2.11 introduced: 0.10.2.0 last_affected: 2.4.1
org.apache.kafka:kafka_2.10 introduced: 0.10.2.0 last_affected: 0.10.2.2
MODERATE CVE-2021-38153 Thu, Sep 23
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
GHSA-3j6g-hxx5-3q26
CVE-2021-38153
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
org.apache.kafka:kafka_2.11 introduced: 2.0.0 last_affected: 2.4.1
org.apache.kafka:kafka_2.12 introduced: 2.0.0 fixed: 2.6.3
org.apache.kafka:kafka_2.12 introduced: 2.7.0 fixed: 2.7.2
org.apache.kafka:kafka_2.12 introduced: 2.8.0 fixed: 2.8.1
org.apache.kafka:kafka_2.13 introduced: 2.4.0 fixed: 2.6.3
org.apache.kafka:kafka_2.13 introduced: 2.7.0 fixed: 2.7.2
… +4 more ranges