CLEANSTART-2026-TN31805: Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field

Q: What level of attacker access is required?

The supplied CVSS vector indicates network reachability, low attack complexity, no required privileges, and no user interaction. This means an unauthenticated remote attacker may be able to target a reachable affected deployment.

Q: What is the likely security impact if exploitation succeeds?

The rating is critical, with a CVSS score of 9.1. The vector indicates high confidentiality and availability impact, while integrity impact is rated as none.

Q: Can I determine whether my installed version is affected from this advisory?

No affected or fixed version range is provided. The advisory identifies the cleanstart/strimzi-kafka-operator package, but version-specific exposure cannot be determined from the available data.

Published Nov 12, 2026

Updated

Security vulnerability affects the strimzi-kafka-operator package. Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field.

Affected Software

1 affected componentFixes available

cleanstart/strimzi-kafka-operator<1.3.0-r0

1.3.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/strimzi-kafka-operator to a version that resolves this vulnerability.
Fixed in 1.3.0-r0

Event History

Nov 12, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111115

Frequently Asked Questions

What level of attacker access is required?

The supplied CVSS vector indicates network reachability, low attack complexity, no required privileges, and no user interaction. This means an unauthenticated remote attacker may be able to target a reachable affected deployment.

What is the likely security impact if exploitation succeeds?

The rating is critical, with a CVSS score of 9.1. The vector indicates high confidentiality and availability impact, while integrity impact is rated as none.

Can I determine whether my installed version is affected from this advisory?

No affected or fixed version range is provided. The advisory identifies the cleanstart/strimzi-kafka-operator package, but version-specific exposure cannot be determined from the available data.

CLEANSTART-2026-TN31805: Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of attacker access is required?

What is the likely security impact if exploitation succeeds?

Can I determine whether my installed version is affected from this advisory?

Company

Resources

Contact

Frequently Asked Questions

What level of attacker access is required?

What is the likely security impact if exploitation succeeds?

Can I determine whether my installed version is affected from this advisory?