Messaging
Apache Kafka: supported versions and open vulnerabilities today
Apache Kafka 4.3, 4.2, 4.1, 4.0 and 3.9 are supported; 3.8 reached end of life on Nov 6, 2024; the latest release is 4.3.1. 2 high or critical advisories for Apache Kafka were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 4.3.1
- GitHub stars
- 33.9k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 6.1 / 10
Supported versions
Security advisories
3 advisories published in the last 12 months, 2 of them high or critical. 10 in total since records began. Checked packages: org.apache.kafka:kafka-clients and org.apache.kafka:kafka_2.13.
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
Fixed in 4.1.2.
Affects org.apache.kafka:kafka-clients.
EPSS: top 40%Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Fixed in 3.9.2, 4.0.2 and 4.1.2.
Affects org.apache.kafka:kafka-clients.
EPSS: top 51%
All org.apache.kafka:kafka-clients advisories on OSV.devAll org.apache.kafka:kafka_2.13 advisories on OSV.dev
Maintenance and supply chain
OpenSSF Scorecard 6.1 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 0 issue updates found in the last 90 days.
Weakest checks
- Over-privileged CI tokens (Token-Permissions 0/10)
- No static analysis (SAST 0/10)
- No fuzzing (Fuzzing 0/10)
Production checklist
Kafka production checklist: 5 checks before launch
- Should do: Enable TLS and SASL authentication with ACLs
- Should do: Replication factor 3 with min.insync.replicas=2 for important topics
- Good to have: Turn off automatic topic creation
Alternatives
RabbitMQ
Robust message broker with flexible routing and delivery guarantees
Strengths
- Low latency message delivery
- Flexible routing (exchanges, bindings)
Trade-offs
- Lower throughput than Kafka
- Messages deleted after consumption
AWS SQS
Fully managed message queuing service
Strengths
- Fully managed (no servers to manage)
- Infinite scalability
Trade-offs
- AWS vendor lock-in
- Message size limited to 256KB
Google Pub/Sub
GCP-managed real-time messaging service
Strengths
- Global availability and low latency
- Automatic scaling
Trade-offs
- GCP vendor lock-in
- Limited message filtering
Azure Service Bus
Enterprise messaging service with queues and pub/sub topics
Strengths
- Enterprise-grade features (dead-letter queues, sessions)
- Both queue and pub/sub patterns
Trade-offs
- Azure vendor lock-in
- Limited to Azure ecosystem
Docs and release notes
Check Apache Kafka in your own stack
This page checks Apache Kafka in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.