Threats tagged 'ghsa-655w-c5cf-wj5f'

A flaw in Kroxylicious's ACL authorizer causes the rules-file parser to improperly unquote regex literals, stripping backslash escapes. This leads to regex rules matching more resources than intended, potentially allowing authenticated Kafka clients to access or modify topics they should not. The issue affects ACL configurations using regex escapes with single backslashes. There is no authentication bypass or availability impact. Mitigation involves doubling backslashes in regex escapes and auditing ACL rules until a fixed release is available.