EN PT-BR
← Voltar ao feed
medium

CERT-FR: Multiple vulnerabilities in Apache Kafka allow DoS, data confidentiality and integrity impact

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 21:00 · coletado há 2 dias

The French CERT-FR published advisory CERTFR-2026-AVI-1415 on 29 October 2026 covering multiple vulnerabilities in Apache Kafka, based on the Apache Kafka CVE list bulletin of 28 October 2026. According to the advisory, the flaws allow an attacker to cause remote denial of service, compromise data confidentiality and compromise data integrity. The advisory also lists a security policy bypass among the impacts. No exploitation in the wild is mentioned.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1415 covers twelve CVEs in Apache Kafka: CVE-2026-110952, CVE-2026-110985, CVE-2026-111073, CVE-2026-111108, CVE-2026-111115, CVE-2026-111496, CVE-2026-111551, CVE-2026-112375, CVE-2026-114349, CVE-2026-115644, CVE-2026-116593 and CVE-2026-83525. Per-CVE details and severity ranking are not given. Overall impacts are remote denial of service, loss of data confidentiality and integrity, and a security policy bypass. Affected: 4.3.x before 4.3.2 and versions before 4.2.2; CVE-2026-110952 is fixed only in 4.4.0 and later. Prerequisites such as authentication are not stated.

Como foi descoberta

The CERT-FR advisory, published on 29 October 2026, says only that multiple vulnerabilities were discovered in Apache Kafka. It is based on the Apache Kafka CVE list bulletin of 28 October 2026. The articles do not say who found the flaws or how they were reported, and no exploitation in the wild is mentioned.

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 14:27.

Detalhes técnicos

  • Affected versions: Apache Kafka 4.3.x prior to 4.3.2, and versions prior to 4.2.2.
  • CVE-2026-110952 is fixed only in versions 4.4.0 and later.
  • CVEs referenced: CVE-2026-110952, CVE-2026-110985, CVE-2026-111073, CVE-2026-111108, CVE-2026-111115, CVE-2026-111496, CVE-2026-111551, CVE-2026-112375, CVE-2026-114349, CVE-2026-115644, CVE-2026-116593, CVE-2026-83525.
  • The advisory does not provide per-CVE technical details, CVSS scores or exploit information.

Remediação

  • Consult the Apache Kafka security bulletin (kafka.apache.org/community/cve-list/) and apply the vendor patches.
  • Upgrade to 4.3.2 or 4.2.2 as applicable, and to 4.4.0 or later to address CVE-2026-110952.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 28/10/2026 21:00 · coletado 30/10 14:01 primeiro registro

    CERT-FR: Multiple vulnerabilities in Apache Kafka allow DoS, data confidentiality and integrity impact

    ler a análise desta fonte

    The French CERT-FR published advisory CERTFR-2026-AVI-1415 on 29 October 2026 covering multiple vulnerabilities in Apache Kafka, based on the Apache Kafka CVE list bulletin of 28 October 2026. According to the advisory, the flaws allow an attacker to cause remote denial of service, compromise data confidentiality and compromise data integrity. The advisory also lists a security policy bypass among the impacts. No exploitation in the wild is mentioned.

    Technical Details

    • Affected versions: Apache Kafka 4.3.x prior to 4.3.2, and versions prior to 4.2.2.
    • CVE-2026-110952 is fixed only in versions 4.4.0 and later.
    • CVEs referenced: CVE-2026-110952, CVE-2026-110985, CVE-2026-111073, CVE-2026-111108, CVE-2026-111115, CVE-2026-111496, CVE-2026-111551, CVE-2026-112375, CVE-2026-114349, CVE-2026-115644, CVE-2026-116593, CVE-2026-83525.
    • The advisory does not provide per-CVE technical details, CVSS scores or exploit information.

    Remediation

    • Consult the Apache Kafka security bulletin (kafka.apache.org/community/cve-list/) and apply the vendor patches.
    • Upgrade to 4.3.2 or 4.2.2 as applicable, and to 4.4.0 or later to address CVE-2026-110952.