Ten Apache Kafka advisories posted, covering DoS, JWT, and file read

1 source · 10 articlesFirst reported Oct 28, 2026 · 17:23 UTCUpdated Oct 28, 2026 · 17:44 UTC (2d ago)1

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

oss-security on October 28 listed ten Apache Kafka flaws; the posts name neither patches nor exploitation.

On October 28, 2026, oss-security posted ten Apache Kafka advisories rated low to important. Impacts include controller and broker crashes or out-of-memory denial of service, skipped or optional JWT checks for SASL/OAUTHBEARER, a Streams StreamThread hang, and unauthorized reading of broker host files or environment variables. CVE-2026-83525 affects 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2; several others list ranges ending at 4.1.2, 4.2.1, and 4.3.0 or 4.3.1. CVE-2026-110952 lists 3.1.0 before 4.4.0. The posts do not state exploitation, and visible text names no patches.

Key facts

CVE-2026-83525 (low): empty-topics FetchSnapshot can crash KRaft; 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2.
CVE-2026-112375 (important): authenticated principal with no grants can read a broker file or environment variable.
CVE-2026-110985 (important): signatures checked only when sasl.oauthbearer.jwks.endpoint.url is set.
CVE-2026-110952 (moderate): issuer and audience checks need explicit settings; 3.1.0 before 4.4.0.
Important allocation DoS: CVE-2026-111108, CVE-2026-111115, CVE-2026-111551, and CVE-2026-114349.
CVE-2026-111073 is moderate telemetry decompress DoS; CVE-2026-111496 is a low Streams hang. No fixes named.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first

Oct 28, 2026oss-security posts ten Apache Kafka vulnerability advisories · oss-security

What each outlet adds

beyond the shared facts

oss-securitySame-day posts for ten Kafka CVEs; several cut off before any fix.

CVEs: CVE-2026-112375 CVE-2026-110985 CVE-2026-114349 CVE-2026-111108 CVE-2026-111115 CVE-2026-111551 CVE-2026-110952 CVE-2026-111073 CVE-2026-83525 CVE-2026-111496

Vendors: Apache Software Foundation Apache
Products: Apache Kafka Kafka Streams

Coverage

oldest first · one row per article · UTC

Oct 28, 17:23 UTC · 2d ago oss-securityFirst report
Kafka FetchSnapshot bug lets privileged clients crash KRaft (CVE-2026-83525)
Authenticated clients with CLUSTER_ACTION can terminate the controller using an empty-topics FetchSnapshotRequest.
Oct 28, 17:25 UTC · 2d ago oss-security
Kafka OAuth JWT issuer and audience checks off by default (CVE-2026-110952)
The bundled JWKS validator always checks the signature, but iss and audience checks need explicit settings.
Oct 28, 17:27 UTC · 2d ago oss-security
Kafka skips JWT signature checks when JWKS URL is unset (CVE-2026-110985)
DefaultJwtValidator verifies signatures only if sasl.oauthbearer.jwks.endpoint.url is set; that setting is unset by default.
Oct 28, 17:29 UTC · 2d ago oss-security
Apache Kafka brokers can run out of memory from protocol arrays (CVE-2026-111108)
Code-generated readers size arrays from a sender-declared count checked only against remaining buffer bytes.
Oct 28, 17:31 UTC · 2d ago oss-security
Kafka PushTelemetry decompression can OOM a broker (CVE-2026-111073)
Only the compressed size is checked against telemetry.max.bytes, default 1 MB, before an unbounded decompress.
Oct 28, 17:33 UTC · 2d ago oss-security
Kafka brokers can OOM on tagged-field counts (CVE-2026-111115)
Flexible-protocol readers keep a RawTaggedField per unknown field, with the count limited only by the request frame.
Oct 28, 17:34 UTC · 2d ago oss-security
Kafka deserializers can exhaust memory from a size field (CVE-2026-111551)
Apache calls the flaw important: a small input can declare a huge size and force a large allocation.
Oct 28, 17:36 UTC · 2d ago oss-security
Kafka Streams can hang on punctuation integer overflow (CVE-2026-111496)
A record timestamp near Long.MAX_VALUE can overflow the next punctuation time and stall a StreamThread.
Oct 28, 17:42 UTC · 2d ago oss-security
Kafka lets unauthorized principals read broker files (CVE-2026-112375)
An authenticated principal with no grants can make a broker return a host file or environment variable.
Oct 28, 17:44 UTC · 2d ago oss-security
Apache Kafka DoS via unbounded allocation on compressed batches (CVE-2026-114349)
Brokers from 0.11.0.0 through the listed 4.3.1 builds allocate an attacker-chosen buffer before validating decompressed data.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Published
CVE-2026-110952 +7 related CVEs CVE-2026-110985 CVE-2026-111073 CVE-2026-111108 CVE-2026-111551 CVE-2026-112375 CVE-2026-114349 CVE-2026-83525	Optional JWT issuer/audience checks in Kafka SASL/OAUTHBEARER	—	—	2d ago
CVE-2026-111115	Unauthenticated heap DoS in Apache Kafka flexible headers	—	—	2d ago
CVE-2026-111496	Integer overflow hang in Kafka Streams stream-time punctuation	—	—	2d ago