What is the CVSS score of CVE-2025-27819?

CVE-2025-27819 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Java are affected by CVE-2025-27819?

Apache Kafka brokers are vulnerable to remote code execution and denial of service attacks if an authenticated attacker with AlterConfigs permissions can modify SASL JAAS configurations.. A patch is available.

How to fix or mitigate CVE-2025-27819?

Within 24 hours: Audit Kafka cluster access logs for any AlterConfigs permission usage and review current SASL JAAS configurations for JndiLoginModule or LdapLoginModule entries. Within 7 days: Upgrade to Kafka 3.4.0+ or apply the system property disable flag (-Dorg.apache.kafka.disallowed.login.modules) to block vulnerable login modules; restrict AlterConfigs permissions to only trusted service accounts. Within 30 days: Complete full cluster upgrade to Kafka 3.9.1/4.0.0 where vulnerable modules are disabled by default, and implement network segmentation to limit Kafka cluster access.

Java CVE-2025-27819

EUVD-2025-17641 HIGH

Deserialization of Untrusted Data (CWE-502)

2025-06-10 security@apache.org

GHSA-mcwh-c9pg-xw43

Denial Of Service Apache Java RCE Authentication Bypass Kafka Red Hat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17641

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 08:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

18 maven packages depend on org.apache.kafka:kafka_2.12 (9 direct, 9 indirect)
54 maven packages depend on org.apache.kafka:kafka_2.13 (18 direct, 36 indirect)

Ecosystem-wide dependent count for version 3.4.0 and other introduced versions.

DescriptionCVE.org

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.

Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0