Apache Kafka Deserialization of Untrusted Data vulnerability
High8.8CVE-2025-27819 · Published Jun 10, 2025 · updated Dec 11, 2025
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kafka:kafka_2.13 Maven | < 3.4.0 | 3.4.0 |
Details and references
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- BIT-kafka-2025-27819, CVE-2025-27819
More Apache Kafka advisories
All Apache Kafka| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 102025 | Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability CVE-2025-27817Medium7.5fixed in 3.9.1 | Medium7.5 | 3.9.1 |
| Jun 102025 | Apache Kafka Deserialization of Untrusted Data vulnerability CVE-2025-27818High8.8fixed in 3.9.1 | High8.8 | 3.9.1 |
| Dec 182024 | Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm CVE-2024-56128Low5.3fixed in 3.7.2, 3.8.1 | Low5.3 | 3.7.2, 3.8.1 |
| Nov 192024 | Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider CVE-2024-31141Medium6.5fixed in 3.7.1 | Medium6.5 | 3.7.1 |
| Apr 7 | Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition CVE-2026-35554High8.7fixed in 3.9.2, 4.0.2, 4.1.2 | High8.7 | 3.9.2, 4.0.2, 4.1.2 |
| Apr 20 | Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation CVE-2026-33557Critical9.1fixed in 4.1.2 | Critical9.1 | 4.1.2 |