CLEANSTART-2026-OT38756: Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field
Security vulnerability affects the strimzi-kafka-operator package. Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 0.51.0-r8
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is rated network-accessible with low attack complexity. It requires no privileges and no user interaction.
What is the expected security impact?
The provided vector rates confidentiality and availability impact as high. Integrity impact is rated as none, and scope is unchanged.
Are affected or fixed package versions identified?
No affected-version range or fixed version is provided in the available data for cleanstart/strimzi-kafka-operator.