Critical vulnerabilities
4 critical vulnerabilities in Apache Kafka
4 vulnerabilities rated critical (CVSS 9.0 or higher) found on 5 November 2026: Apache Kafka (4).
- 4 critical
Memory corruption in Apache Kafka · Servers and applications
CVE-2026-111496
Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
- Severity
- Critical 9.1
- Published
- 28 Oct 2026
| Software | Affected versions |
|---|---|
| Apache KafkaServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-111496
Apache Kafka · Servers and applications
CVE-2026-111115
Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
- Severity
- Critical 9.1
- Published
- 28 Oct 2026
| Software | Affected versions |
|---|---|
| Apache KafkaServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-111115
Apache Kafka · Servers and applications
CVE-2026-111108
Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
- Severity
- Critical 9.1
- Published
- 28 Oct 2026
| Software | Affected versions |
|---|---|
| Apache KafkaServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-111108
Apache Kafka · Servers and applications
CVE-2026-110985
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
- Severity
- Critical 9.1
- Published
- 28 Oct 2026
| Software | Affected versions |
|---|---|
| Apache KafkaServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-110985
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.