CVE-2025-27819: Apache Kafka Deserialization of Untrusted Data Vulnerability
Summary
CVE-2025-27819: Apache Kafka Deserialization of Untrusted Data vulnerability. Affects org.apache.kafka:kafka versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- kafka · Bitnami
The same CVE-2025-27819 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is a distributed event streaming platform capable of handling trillions of events a day. It is designed for high-throughput, fault-tolerant, and scalable messaging. Kafka is widely used for building real-time data pipelines and streaming applications. However, it has been found to be vulnerable to a deserialization issue that can lead to remote code execution (RCE) or denial of service (DoS) attacks, particularly through its SASL JAAS JndiLoginModule configuration.
Vulnerability Detail
The vulnerability arises from the deserialization of untrusted data in the Apache Kafka brokers and Kafka Connect API. An attacker with the ability to connect to the Kafka cluster and possessing the AlterConfigs permission can exploit this vulnerability. This could lead to unauthorized access, data manipulation, or service disruption. The issue is particularly critical as it allows for remote code execution, making it a high-severity threat.
How To Fix
Minimum fixed version
3.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the usage of the problematic login modules by adding the following system property when starting your Kafka broker:
-Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule
Conclusion
The Apache Kafka deserialization vulnerability (CVE-2025-27819) poses a significant risk to users, allowing for potential remote code execution and service disruption. It is crucial to update to the patched version or implement the recommended workarounds to mitigate the risk.
See every vulnerability recorded for org.apache.kafka:kafka →
FAQ
CVE-2025-27819 is a vulnerability in Apache Kafka that allows for remote code execution or denial of service through insecure deserialization of data.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. You can access the Vulert playground without signup at Vulert Scanner.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, or service disruption, posing a significant risk to your Kafka deployment.
Versions prior to 3.4.0 are affected by this vulnerability. It is recommended to upgrade to version 3.4.0 or later.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka.
