RHSA-2026:54435 Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update
eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js: Next.js: Authorization bypass via crafted query parameters next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js: Next.js: Denial of Service via Image Optimization API Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests next.js: Next.js: Denial of Service via crafted POST requests to server actions netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution strimzi-cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak js-yaml: js-yaml: Denial of Service via crafted YAML documents io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2) next: Next.js: Denial of Service via crafted requests to App Router with Server Actions next: Next.js: Denial of Service via malicious image optimization next: Next.js: Server-Side Request Forgery vulnerability next: Next.js: Denial of Service via excessive memory consumption in Server Actions next: Next.js: Information disclosure via server-side fetch cache next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions postcss: PostCSS: Information disclosure via crafted sourceMappingURL
CVSS v3.1 score: 7.5