The Drupal Commerce Stripe module allows payment processing via multiple Stripe APIs. A vulnerability exists where the module does not sufficiently verify the cryptographic signature of webhook events if the webhook signing secret is not properly configured. This issue is mitigated if a webhook signing secret is set or if the payment gateway plugin does not use webhooks. Fixed versions 1.4.0 and 2.2.3 address this vulnerability.
A vulnerability in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, allows attackers to bypass the root element check during deserialization of certain configuration objects. This occurs because Jenkins does not consistently enforce restrictions on deserializing objects marked as storing their configuration in independent top-level files when they appear as nested values. This flaw could enable injection of nested objects.
A vulnerability in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, allows attackers with Agent/Configure permission to execute arbitrary code on the Jenkins controller JVM. This occurs because older agent launch commands are converted into launchers by the Command Agent Launcher Plugin without administrator approval checks.
CVE-2026-112375 is a missing authorization vulnerability in Apache Kafka that allows an authenticated principal without any authorization grants to read files or environment variables from the broker host. This occurs because configuration validation happens before authorization checks, enabling resolution of configuration variables that expose sensitive data. The issue affects Kafka versions from 3.2.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. The vulnerability is mitigated in versions 4.2.2, 4.3.2, and 4.4.0 by enforcing authorization before configuration validation and restricting config-provider usage. Running brokers under least-privileged OS accounts is recommended as additional defense.
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.
When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.
While the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.
Impact:
An unauthenticated attacker with network access to the admin listener can:
1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use.
2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress
logging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.
Mitigation:
Users who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the REST extensions specified via "rest.extension.classes" will also apply to "admin.listeners".
Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.
Impact:
A single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed.
Mitigation:
Upgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.
Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request can declare far more elements than the buffer holds and still pass. For a keyed array the reader then allocates an ImplicitLinkedHashCollection of capacity (2 * count +1), so a request of a few tens of megabytes can force a heap allocation several times larger before any element is read. The pattern is emitted into every generated reader, so it affects all Kafka API types with an array field.
Impact:
Request parsing happens before any authorization check. On a listener that does not require authentication (for example PLAINTEXT), an unauthenticated attacker can send a few concurrent requests that each declare a very large=
array length and allocate many times their wire size in broker heap, crashing the broker with an OutOfMemoryError. The reporter demonstrated three concurrent ~90 MB ProduceRequest (v3) connections exhausting a 1 GB heap (~8x amplification). On listeners that require authentication, the attacker needs valid credentials but no specific ACL, since parsing precedes authorization..
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. Until then, lowering socket.request.max.bytes and restricting network access to broker listeners reduces, but does not remove, exposure.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: generated readers cap the initial array pre-allocation at MessageUtil.MAX_PREALLOCATED_ARRAY_CAPACITY (1000) and grow it on demand, and reject a declared array length above MessageUtil.MAX_ARRAY_LENGTH (1,000,000).
The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the decompressed output size, growing a heap buffer until the compressed input is exhausted. A small, highly compressible payload (for example gzip-compressed zeros) can therefore expand to hundreds of megabytes of broker heap.
Impact:
An authenticated client can send a PushTelemetry request with a small compressed payload that decompresses to a very large size, consuming broker heap out of proportion to the request size. Repeated or concurrent requests can exhaust the broker heap and cause an OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers can affect cluster availability. PushTelemetry is available to any authenticated client and is not gated by an ACL.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully prevents the amplification, because telemetry.max.bytes bounds only the compressed size; lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a partial mitigation.
Resolution:
- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an over-large or highly compressible payload is rejected instead of being fully expanded in heap. The decompressed size is therefore bounded by default.
CVE-2026-110985 is a vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER authentication with the default JWT validator. If the configuration parameter sasl.oauthbearer.jwks.endpoint.url is not set and no custom verification key resolver is provided, the broker falls back to a validator that does not verify JWT signatures, algorithms, or issuers. This allows an unauthenticated remote attacker to forge any JWT token, including those asserting superuser privileges, gaining full cluster access. The issue affects specific Kafka versions prior to fixed releases. The vulnerability is resolved in Apache Kafka versions 4.2.2, 4.3.1, and 4.4.0, where the broker fails to start if signature verification is not properly configured.
CVE-2026-103411 is an Integer Underflow vulnerability in the DhcpMessageDecoder component of Juniper Networks Session Smart Router. It allows an attacker with local network access to cause information disclosure and denial of service by sending a malicious DHCP reply. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS score is 7.1, indicating a high severity impact.
Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator verify JWT signatures but do not enforce issuer and audience claim checks by default. This can allow tokens from different issuers or without audience claims to authenticate if the JWKS endpoint serves keys for multiple issuers. From version 4.4.0, Kafka requires explicit configuration of issuer and audience checks or allows opting out. Versions 3.1.0 through before 4.4.0 are affected if these settings are not configured.
Incorrect operator (CWE-480) in the FetchSnapshot RPC handler
in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2
on all platforms allows an authenticated attacker with
CLUSTER_ACTION privilege to cause a denial of service
(controller process termination) via a crafted
FetchSnapshotRequest with an empty topics array or a topic
with no partitions.
Users are recommended to upgrade to version 4.2.2, 4.3.2, or
4.4.0, which fix this issue. Users on unsupported branches
(4.1.x and earlier) should upgrade to 4.2.2 or later.
CVE-2026-103409 is a critical vulnerability in Juniper Networks Session Smart Router that allows unauthenticated network attackers to gain administrative privileges by exploiting a missing authentication check on a critical function. This issue affects devices prior to onboarding to Mist/Conductor and is fixed in versions 7.0.5, 7.1.7, and 7.2.3.
CVE-2026-103408 is a stack-based buffer overflow vulnerability in the DHCP client of Juniper Networks Session Smart Router. It allows an unauthenticated attacker on the local network to execute remote code by sending a malicious DHCP reply. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. It has a high severity with a CVSS score of 8.8.
CVE-2026-103407 is a path traversal vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ConfigDirector component. It allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-103406 is a critical OS command injection vulnerability in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. It allows a remote attacker to execute arbitrary commands with root privileges by sending a specially crafted salt minion ID. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The flaw has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-103405 is an injection vulnerability in the web server component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker to inject arbitrary HTTP headers through unsanitized request body parameters. The flaw is classified as CWE-74, indicating improper neutralization of special elements in output used by a downstream component. This vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS 3.1 base score is 5.8, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. No known exploits are reported in the wild.
CVE-2026-103404 is a vulnerability in Juniper Networks Session Smart Conductor's RoutingManager component where incorrect permission assignment allows a local user to access sensitive routing credentials. This occurs through triggering processes that write to the /tmp directory. The issue affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The vulnerability has a CVSS score of 6.8, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.
CVE-2026-103403 is an OS Command Injection vulnerability in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker with limited privileges to execute arbitrary commands and delete files by exploiting improper neutralization of special elements during audit rule deletion. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. It has a high severity with a CVSS score of 8.8.
CVE-2026-103402 is a high-severity vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor. It involves insufficient verification of data authenticity in the PCLI component, allowing an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3.