Streams for Apache Kafka 3.2.0 vulnerabilities

6 known vulnerabilities in Streams for Apache Kafka 3.2.0 from Red Hat. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  axios: Unintended Proxy or Intermediary

  CVE-2025-62718Apr 9, 2026AxiosEPSS 1.21%

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IP

• 9.8 Critical severity

  lodash: Improper Control of Generation of Code

  CVE-2026-4800Mar 31, 2026LodashEPSS 2.81%

  The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as o

• 7.5 High severity

  netty: Allocation of Resources Without Limits or Throttling

  CVE-2026-33871Mar 27, 2026NettyEPSS 1.36%

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server

• 7.5 High severity

  netty: Inconsistent Interpretation of HTTP Requests

  CVE-2026-33870Mar 27, 2026Netty

  Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versi

• 7.5 High severity

  net/url: Allocation of Resources Without Limits or Throttling

  CVE-2025-61726Jan 28, 2026Go standard libraryEPSS 2.29%

  The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded

• 7.5 High severity

  react-server-dom-webpack: Uncontrolled Resource Consumption

  CVE-2026-23864Jan 26, 2026MetaEPSS 2.58%

  Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP re