Maven/org.apache.kafka:kafka_2.11 CVE-2024-56128: medium 5.3, EPSS 0.82%

Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-p7c9-8xx8-h74f#Maven/org.apache.kafka:kafka_2.11
• https://nvd.nist.gov/vuln/detail/CVE-2024-56128
• https://github.com/apache/kafka/commit/2cbc5bd3ca22185d9cd357c9db23a2cfb43a0fff
• https://datatracker.ietf.org/doc/html/rfc5802
• https://datatracker.ietf.org/doc/html/rfc5802#section-9
• https://github.com/apache/kafka
• https://kafka.apache.org/documentation/#security_sasl_scram_security
• https://lists.apache.org/thread/84dh4so32lwn7wr6c5s9mwh381vx9wkw
• http://www.openwall.com/lists/oss-security/2024/12/18/3

CVE-2024-56128 · published 2024-12-18T15:33:00Z · modified 2026-09-10T03:50:21.892841354Z · JSON