UpHeron
All vulnerabilities

Servers and applications

CVE-2025-27819

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster…

Severity
High 7.5
Published
10 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache KafkaServers and applications · cpe:a:apache:kafka
  • From 2.0.0 up to 3.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-27819
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-27819