org.apache.kafka:kafka-streams vulnerabilities

CVEs whose affected-version data names the org.apache.kafka:kafka-streams package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

2 CVEsRSS

CVE-2026-111496None

3d ago

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or nea…

▾ SunlitApache Software Foundation · org.apache.kafka:kafka-streamsEPSS 0.20%via CVEORG

CVE-2026-111551None

3d ago

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore …

▾ SunlitApache Software Foundation · org.apache.kafka:kafka-streamsEPSS 0.22%via CVEORG