streams for Apache Kafka 3/kafka-clients

Red Hat · Package

6 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementationCVE-2026-33557 · GHSA-28JG-CGG7-J4WC	org.apache.kafka:kafka-clients Red Hat build of Debezium 3/connect-api	MavenRed Hat	Critical	Fix reported	2026-04-24
kafka: kafka: Denial of Service via excessive memory allocation during record decompressionCVE-2026-114349	Red Hat Fuse 7/kafka-clients Red Hat build of Apache Camel 4 for Quarkus 3/kafka-clients	Red Hat	Medium	No fix reported	Not recorded
org.apache.kafka/kafka-clients: Apache kafka: Denial of Service via excessive memory allocation during request parsingCVE-2026-111108	streams for Apache Kafka 3/kafka-clients	Red Hat	High	No fix reported	Not recorded
org.apache.kafka/kafka-clients: Apache Kafka: Denial of Service via uncontrolled memory allocation in flexible request headersCVE-2026-111115	Red Hat Fuse 7/kafka-clients Red Hat build of Apache Camel 4 for Quarkus 3/kafka-clients	Red Hat	High	No fix reported	Not recorded
org.apache.kafka/kafka-streams: org.apache.kafka/kafka-clients: Apache Kafka: Denial of Service via memory exhaustion during deserializationCVE-2026-111551	Red Hat Fuse 7/kafka-clients Red Hat Fuse 7/kafka-streams	Red Hat	High	No fix reported	Not recorded
org.apache.kafka/kafka-clients: Apache Kafka: Denial of Service via unbounded telemetry payload decompressionCVE-2026-111073	OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless/openshift-serverless-1/kn-ekb-receiver-rhel9	Red Hat	Medium	No fix reported	Not recorded