Red Hat Security Advisory: Streams for Apache Kafka 3.0.1 release and security update
Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 3.0.1 serves as a replacement for Red Hat Streams for Apache Kafka 3.0.0, and includes security and bug fixes, and enhancements. * Cruise Control, Drain Cleaner: Netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability [amq-st-3.0] "(CVE-2025-55163)" * Kafka: org.apache.commons:commons-lang3 : Uncontrolled Recursion [amq-st-3.0] "(CVE-2025-48924)"
AI Analysis
Technical Summary
This advisory covers two security vulnerabilities in Red Hat Streams for Apache Kafka. CVE-2025-48924 is an uncontrolled recursion vulnerability in the Apache Commons Lang library used by Kafka, which could lead to resource exhaustion or denial of service. CVE-2025-55163 is a HTTP/2 denial-of-service vulnerability in the Netty codec-http2 component, known as 'Netty MadeYouReset'. Red Hat Streams for Apache Kafka 3.0.1 replaces version 3.0.0 and includes fixes for these issues along with other bug fixes and enhancements. The update is rated as having a moderate security impact by Red Hat. No CVSS scores are provided in the advisory. The vendor recommends applying this update after ensuring all previous errata are applied.
Potential Impact
The uncontrolled recursion vulnerability (CVE-2025-48924) may allow an attacker to cause resource exhaustion or denial of service in applications using Apache Commons Lang within Kafka. The HTTP/2 DDoS vulnerability (CVE-2025-55163) in Netty codec-http2 could be exploited to disrupt service availability via denial-of-service attacks. Red Hat rates the overall security impact of these vulnerabilities as moderate. There are no known exploits in the wild at the time of this advisory.
Mitigation Recommendations
Red Hat has released Streams for Apache Kafka 3.0.1 as a replacement for version 3.0.0, which includes fixes for these vulnerabilities. Users should update to version 3.0.1 after applying all previously released errata relevant to their systems. Detailed update instructions are available from Red Hat's customer portal. No additional mitigation steps are indicated by the vendor.
Red Hat Security Advisory: Streams for Apache Kafka 3.0.1 release and security update
Description
Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 3.0.1 serves as a replacement for Red Hat Streams for Apache Kafka 3.0.0, and includes security and bug fixes, and enhancements. * Cruise Control, Drain Cleaner: Netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability [amq-st-3.0] "(CVE-2025-55163)" * Kafka: org.apache.commons:commons-lang3 : Uncontrolled Recursion [amq-st-3.0] "(CVE-2025-48924)"
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers two security vulnerabilities in Red Hat Streams for Apache Kafka. CVE-2025-48924 is an uncontrolled recursion vulnerability in the Apache Commons Lang library used by Kafka, which could lead to resource exhaustion or denial of service. CVE-2025-55163 is a HTTP/2 denial-of-service vulnerability in the Netty codec-http2 component, known as 'Netty MadeYouReset'. Red Hat Streams for Apache Kafka 3.0.1 replaces version 3.0.0 and includes fixes for these issues along with other bug fixes and enhancements. The update is rated as having a moderate security impact by Red Hat. No CVSS scores are provided in the advisory. The vendor recommends applying this update after ensuring all previous errata are applied.
Potential Impact
The uncontrolled recursion vulnerability (CVE-2025-48924) may allow an attacker to cause resource exhaustion or denial of service in applications using Apache Commons Lang within Kafka. The HTTP/2 DDoS vulnerability (CVE-2025-55163) in Netty codec-http2 could be exploited to disrupt service availability via denial-of-service attacks. Red Hat rates the overall security impact of these vulnerabilities as moderate. There are no known exploits in the wild at the time of this advisory.
Mitigation Recommendations
Red Hat has released Streams for Apache Kafka 3.0.1 as a replacement for version 3.0.0, which includes fixes for these vulnerabilities. Users should update to version 3.0.1 after applying all previously released errata relevant to their systems. Detailed update instructions are available from Red Hat's customer portal. No additional mitigation steps are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:16407
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-55163"]
Threat ID: 6a294d7e8dd33fbd853ac709
Added to database: 06/10/2026, 11:41:50 UTC
Last enriched: 08/04/2026, 15:47:19 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 164
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.