Deserialization of Untrusted Data in Apache Kafka - CVE-2025-27818

Vulnerability identifier: #VU112255

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27818

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user can set the sasl.jaas.config property for connector's Kafka clients to 'com.sun.security.auth.module.LdapLoginModule' through various override properties (producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config). This configuration enables the server to connect to an attacker's LDAP server and deserialize the LDAP response, potentially leading to the execution of java deserialization gadget chains on the Kafka connect server. 

Apache Kafka
IBM Operator for Apache Flink
IBM Fusion HCI
IBM Spectrum Control
IBM Maximo Asset Management
IBM Business Automation Workflow
IBM Maximo Application Suite - Manage Component
App Connect Enterprise Certified Container
Operations Analytics - Log Analysis
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Maximo Application Suite - Monitor Component
IBM Business Automation Manager Open Editions
Integration Bus for z/OS
InfoSphere Data Replication
Business Automation Insights
envoy
watsonx.data
IBM Qradar SIEM
IBM App Connect Enterprise
AMQ Streams

Install updates from vendor's website.

Apache Kafka - update to 3.9.1
IBM Operator for Apache Flink - update to 1.4.5
Operations Analytics - Log Analysis - update to 1.3.8.3 IF1
envoy - addressed in versions 1.33.10, 1.34.8, 1.35.4
IBM Fusion HCI - update to 2.11.0
watsonx.data - update to 2.2.1
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.1
IBM Spectrum Control - update to 5.4.13.2
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
IBM Maximo Asset Management - update to 7.6.1.3.35
Maximo Application Suite - Monitor Component - addressed in versions 8.10.21, 8.11.19, 9.0.11
IBM Business Automation Manager Open Editions - update to 9.2.1
Integration Bus for z/OS - update to 10.1.0.6
IBM App Connect Enterprise - addressed in versions 12.0.12.16, 13.0.4.1
IBM Business Automation Workflow - addressed in versions 24.0.0-IF007, 24.0.1-IF005, 25.0.0-IF001
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
AMQ Streams - update to 3.1.0
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.28, 8.7.22, 9.0.15, 9.1.1
App Connect Enterprise Certified Container - addressed in versions 12.0.14, 12.14.0

• https://kafka.apache.org/cve-list
• http://www.openwall.com/lists/oss-security/2025/06/09/2

• Deserialization of untrusted data in Apache Kafka
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus for z/OS
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Fusion
• Envoy update for third-party components
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Spectrum Control
• Red Hat AMQ Streams update for Apache Kafka
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM InfoSphere Data Replication
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Operator for Apache Flink