Find, fix and prevent vulnerabilities in your code.

Overview

org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the form of nonce verification that fails to comply with RFC 5802 in the SCRAM implementation. If TLS is not in use for SCRAM exchanges - which is an insecure configuration in its own right - an attacker can intercept and replay the authentication messages.

Configurations with SASL_PLAINTEXT set for listeners are vulnerable.

Remediation

Upgrade org.apache.kafka:kafka-clients to version 3.7.2, 3.8.1 or higher.

References

• Additional Information
• Apache Advisory
• GitHub Commit
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

Upgrade org.apache.commons:commons-lang3 to version 3.18.0 or higher.

References

• Apache Pony Mail
• GitHub Commit

Overview

org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm.

Affected versions of this package are vulnerable to Out-of-bounds Read due to the use of the insecure LZ4_decompress_fast in the underlying lz4 library, which lacks bounds checks. An attacker can cause denial of service or access sensitive memory contents by providing specially crafted compressed input.

Workaround

• Applications using LZ4Factory.nativeInstance() in conjunction with .fastDecompressor() can switch to .safeInstance() or .safeDecompressor().
• Applications using LZ4Factory.unsafeInstance(), .fastestInstance() or .fastestJavaInstance() can switch to .safeInstance().

Notes

• The official org.lz4:lz4-java library has not been patched and the project is discontinued.

• org.lz4:lz4-java:1.8.1 relocates the pacakge to at.yawk.lz4:lz4-java, which is a community-maintained fork of the library that fixes this vulnerability.

Remediation

Upgrade org.lz4:lz4-java to version 1.8.1 or higher.

References

• GitHub Commit
• GitHub Release
• Vulnerability Report

Overview

org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JndiLoginModule process in the SASL authentication mechanism. An attacker can execute arbitrary code or cause a denial of service by supplying a malicious JNDI URI in the broker's configuration.

Note:

This is only exploitable if the attacker can connect to the Kafka cluster and has the AlterConfigs permission on the cluster resource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade org.apache.kafka:kafka-clients to version 3.9.1 or higher.

References

• GitHub Commit
• Kafka Security Advisories
• Red Hat Bugzilla Bug

Overview

org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to improper handling of configuration data in the sasl.jaas.config property. An attacker can achieve arbitrary code execution by injecting a malicious configuration that causes the server to connect to an attacker-controlled LDAP server and deserialize untrusted data, leading to execution of deserialization gadget chains.

Note:

This is only exploitable if the attacker has access to alterConfig for a cluster resource or Kafka Connect worker and can create or modify connectors with arbitrary Kafka client SASL JAAS configuration.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade org.apache.kafka:kafka-clients to version 3.9.1 or higher.

References

• GitHub Commit
• Kafka Security Advisories
• Red Hat Bugzilla Bug

Overview

org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. Kafka is vulnerable to the disclosure of sensitive information via the toString methods of IncrementalAlterConfigsRequest and AlterUserScramCredentialsRequest. An attacker can expose config values, SCRAM salts, and salted passwords by triggering request logging or any code path that renders these request objects as strings. This leaks administrative secrets and credential material into logs and diagnostics, allowing unauthorized readers of those logs to recover protected configuration values and authentication data.

Workarounds

• Keep Kafka clients at the default INFO log level and do not enable DEBUG logging for NetworkClient, so request and response objects are not rendered into logs, and sensitive config values, SCRAM salts, and salted passwords are not exposed.

Remediation

Upgrade org.apache.kafka:kafka-clients to version 3.9.2, 4.0.1 or higher.

References

• Apache Security Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• OSS Security Advisory

Overview

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the toXmlDocument function of XmlStringPrettyFormatter. An attacker can read arbitrary local files, perform server-side request forgery, or cause denial of service by providing crafted XML input containing external entities.

Note: This formatter is used by isXmlEqualTo(CharSequence) and xmlPrettyFormat(String) and could be exploited if untrusted XML input is processed by the methods.

Workaround

Replace use of isXmlEqualTo(CharSequence) with XMLUnit.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade org.assertj:assertj-core to version 3.27.7 or higher.

References

• GitHub Commit
• GitHub Release

Overview

org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the decompression process when the output buffer is reused without being cleared. An attacker can access sensitive information from previous buffer contents by providing crafted compressed input.

Note:

• JNI implementations are not vulnerable.
• LZ4Factory.safeInstance(), LZ4Factory.unsafeInstance(), and LZ4Factory.fastestJavaInstance() are all vulnerable.
• nativeInstance().fastDecompressor() is vulnerable but nativeInstance().safeDecompressor() is not.
• This vulnerability is distinct from the one described in CVE-2025-12183, and was discovered during follow-up research.

Workaround

This vulnerability can be mitigated by zeroing the output buffer before passing it to the decompression function.

Remediation

There is no fixed version for org.lz4:lz4-java.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a missing upper bound check on chunk length in the SnappyInputStream function. An attacker can decompress data with an excessively large chunk size.

Remediation

Upgrade org.xerial.snappy:snappy-java to version 1.1.10.4 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) via the hasNextChunk function due to improper validation of the chunkSize variable value.

Exploiting this vulnerability is possible by passing a negative number (such as 0xFFFFFFFF, which is -1), which will cause the code to raise a java.lang.NegativeArraySizeException exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), raising the fatal java.lang.OutOfMemoryError error.

PoC

package org.example;
import org.xerial.snappy.SnappyInputStream;

import java.io.*;

public class Main {

    public static void main(String[] args) throws IOException {
        byte[] data = {-126, 'S', 'N', 'A', 'P', 'P', 'Y', 0, 0, 0, 0, 0, 0, 0, 0, 0,(byte) 0x7f, (byte) 0xff, (byte) 0xff, (byte) 0xff};
        SnappyInputStream in = new SnappyInputStream(new ByteArrayInputStream(data));
        byte[] out = new byte[50];
        try {
            in.read(out);
        }
        catch (Exception ignored) {

        }
    }
}

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.xerial.snappy:snappy-java to version 1.1.10.1 or higher.

References

• GitHub Commit
• Vulnerable Code