HighCVE-2025-27817

glib: Server-Side Request Forgery (SSRF) (CVE-2025-27817)

Published 29.10.2026Sources: BSI

Actively exploited
Source: VulnCheck KEV (opens in a new tab) How we classify

What is affected, what to do

The vulnerability is being actively exploited; treat it as a priority. Update glib to version 2.86.3, aiohttp to version 3.13.3, Apache Commons Lang to version 3.18.0.

Affected: Apache Kafka Client lte 3.1.0..3.9.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

7.5

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: NVD, CVSS v3

7.5

CVSS v3

Severity High on the scale from 0 to 10.

Source: BSI

68.8 %

EPSS score

High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

Source: FIRST EPSS, percentile 99.35

Show all metrics

Severity: High
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 92.18 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 7.5 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 7.5
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 68.8 %; High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 99.35; Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: —
Published: 29.10.2026
CISA assessment (SSVC): Exploitation: none known · automatable · Technical impact: partial; Source: CISA Vulnrichment, as of 10 June 2025
CWE CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. Read in glossary: CWE-918

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.

Source: BSI WID Portal

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
—	glib	`< 2.86.3`	`2.86.3`
aio-libs	aiohttp	`< 3.13.3`	`3.13.3`
Apache Software Foundation	Apache Commons Lang	`2.0 – ≤ 2.6` `3.0 – < 3.18.0`	— `3.18.0`
Apache Software Foundation	Apache Kafka Client	`3.1.0 – ≤ 3.9.0`	—
Apache Software Foundation	Apache Log4j	`1.0.4 – < 2`	`2`
Apache Software Foundation	Apache Log4j Core	`2.0-beta9 – < 2.25.3` `3.0.0-alpha1 – ≤ 3.0.0-beta3`	`2.25.3` —
dain	snappy	`< 0.5`	`0.5`
jettison	jettison	`< 1.5.4`	`1.5.4`
netty	netty	`≤ 4.1.124.Final, < 4.1.125.Final` `≤ 4.2.4.Final, < 4.2.5.Final`	— —
Python Packaging Authority	pip	`< 25.3`	`25.3`
Red Hat	Red Hat Ceph Storage 8	`< 1769512383`	`1769512383`
Red Hat	Red Hat Discovery 2	`< 1769104765` `< 1769111774`	`1769104765` `1769111774`
Red Hat	Red Hat Enterprise Linux 10	`< 0:2.80.4-10.el10_1.12` `< 0:2.87.0-1.el10`	`0:2.80.4-10.el10_1.12` `0:2.87.0-1.el10`
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	`< 0:2.80.4-4.el10_0.8`	`0:2.80.4-4.el10_0.8`
Red Hat	Red Hat Enterprise Linux 6	`—`	—
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	`< 0:2.56.1-11.el7_9`	`0:2.56.1-11.el7_9`
Red Hat	Red Hat Enterprise Linux 8	`< 0:2.56.4-168.el8_10`	`0:2.56.4-168.el8_10`
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	`< 0:2.56.4-8.el8_2.4`	`0:2.56.4-8.el8_2.4`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	`< 0:2.56.4-10.el8_4.4`	`0:2.56.4-10.el8_4.4`
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	`< 0:2.56.4-10.el8_4.4`	`0:2.56.4-10.el8_4.4`
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	`< 0:2.56.4-158.el8_6.4`	`0:2.56.4-158.el8_6.4`
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	`< 0:2.56.4-158.el8_6.4`	`0:2.56.4-158.el8_6.4`
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	`< 0:2.56.4-158.el8_6.4`	`0:2.56.4-158.el8_6.4`
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	`< 0:2.56.4-164.el8_8`	`0:2.56.4-164.el8_8`
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	`< 0:2.56.4-164.el8_8`	`0:2.56.4-164.el8_8`
Red Hat	Red Hat Enterprise Linux 9	`< 0:2.68.4-18.el9_7.1` `< 0:2.78.6-3.el9`	`0:2.68.4-18.el9_7.1` `0:2.78.6-3.el9`
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	`< 0:2.68.4-5.el9_0.4`	`0:2.68.4-5.el9_0.4`
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	`< 0:2.68.4-7.el9_2.4`	`0:2.68.4-7.el9_2.4`
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	`< 0:2.68.4-14.el9_4.5`	`0:2.68.4-14.el9_4.5`
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	`< 0:2.68.4-16.el9_6.4`	`0:2.68.4-16.el9_6.4`
Red Hat	Red Hat Hardened Images	`< 2.88.0-1.1.hum1`	`2.88.0-1.1.hum1`
Red Hat	Red Hat Insights proxy 1.5	`< 1770740405`	`1770740405`
Red Hat	Red Hat OpenShift Container Platform 4	`—`	—
Red Hat	Red Hat OpenShift Container Platform 4.12	`< 412.86.202602021310-0`	`412.86.202602021310-0`
Red Hat	Red Hat OpenShift Container Platform 4.13	`< 413.92.202602240113-0`	`413.92.202602240113-0`
Red Hat	Red Hat OpenShift Container Platform 4.14	`< 414.92.202602171627-0`	`414.92.202602171627-0`
Red Hat	Red Hat OpenShift Container Platform 4.15	`< 415.92.202603101737-0`	`415.92.202603101737-0`
Red Hat	Red Hat OpenShift Container Platform 4.16	`< 416.94.202602101357-0`	`416.94.202602101357-0`
Red Hat	Red Hat OpenShift Container Platform 4.17	`< 417.94.202602090846-0`	`417.94.202602090846-0`
Red Hat	Red Hat OpenShift Container Platform 4.18	`< 418.94.202602022246-0`	`418.94.202602022246-0`
Red Hat	Red Hat OpenShift Container Platform 4.19	`< 4.19.9.6.202602112047-0`	`4.19.9.6.202602112047-0`
Red Hat	Red Hat Update Infrastructure 5	`< 1770646925`	`1770646925`

From bundled advisories, not CVE-specific (54)

Product list of a bundled advisory that does not state which product this CVE affects.

Products from bundled advisories
		Affected versions	Fixed in
Atlassian	Bamboo	`< 10.2.18` `< 12.1.6`	`10.2.18` `12.1.6`
Atlassian	Bitbucket	`< 10.2.2` `< 9.4.19`	`10.2.2` `9.4.19`
Atlassian	Confluence	`< 10.2.10` `< 9.2.19`	`10.2.10` `9.2.19`
Atlassian	Jira	`< 10.3.12` `< 10.3.19` `< 11.1.1` `< 11.3.4` `< 9.12.28`	`10.3.12` `10.3.19` `11.1.1` `11.3.4` `9.12.28`
Atlassian	Jira Service Management	`< 10.3.19` `< 11.3.4`	`10.3.19` `11.3.4`
Dell	Avamar	`Data Store Gen4T / Gen5A <19.9 OS Security Rollup 2025R4` `NDMP Accelerator <19.9 OS Security Rollup 2025R4` `Virtual Edition <19.9 OS Security Rollup 2025R4` `VMware Image Backup Proxy <19.9 OS Security Rollup 2025R4`	— — — —
Dell	Avamar Data Store Gen4T / Gen5A	`< 19.10` `< 19.10-SP1` `< 19.12`	`19.10` `19.10-SP1` `19.12`
Dell	Avamar NDMP Accelerator	`< 19.10` `< 19.10-SP1` `< 19.12`	`19.10` `19.10-SP1` `19.12`
Dell	Avamar Virtual Edition	`< 19.10` `< 19.10-SP1` `< 19.12,`	`19.10` `19.10-SP1` `19.12,`
Dell	Avamar VMware Image Backup Proxy	`< 19.10` `< 19.10-SP1` `< 19.12`	`19.10` `19.10-SP1` `19.12`
Dell	Data Protection Advisor	`< 19.12`	`19.12`
Dell	NetWorker	`Virtual Edition <19.12 OS Security Rollup 2025R4`	—
Dell	NetWorker Virtual Edition	`< 19.10` `< 19.11` `< 19.9`	`19.10` `19.11` `19.9`
Dell	NetWorker vProxy	`< 19.13.0.3`	`19.13.0.3`
Dell	Secure Connect Gateway	`< 5.34.00.16`	`5.34.00.16`
Dell	Secure Connect Gateway Appliance	`< 5.32.00.18`	`5.32.00.18`
HCL	BigFix	`WebUI`	—
HCL	Commerce	`< 25.09.17.0`	`25.09.17.0`
IBM	Storage Scale	`< 5.2.3.5`	`5.2.3.5`
RealObjects	PDFreactor	`< 12.4`	`12.4`
Red Hat	Ansible Automation Platform	`< 2.5` `< 2.6`	`2.5` `2.6`
Red Hat	Enterprise Linux	`10.0 Extended Update Support` `8.8` `Apache Camel 1`	— — —
Red Hat	Enterprise Linux Integration Camel for Spring Boot	`< 3.20.1`	`3.20.1`
Red Hat	Enterprise Linux Quarkus	`< 3.20.3`	`3.20.3`

Vendors and products

Affected operating systems

Affected operating systems

Linux	debian	apache-log4j2	`bullseye`
Linux	redhat	enterprise_linux_for_arm_64	`9.4`
Linux	redhat	enterprise_linux_for_arm_64	`9.0`
Linux	redhat	enterprise_linux_for_arm_64	`9.2`
Linux	redhat	enterprise_linux_for_arm_64	`8.0`
Linux	redhat	enterprise_linux_for_arm_64	`10.0`
Linux	redhat	enterprise_linux_for_arm_64	`9.6`
Linux	redhat	enterprise_linux_for_arm_64_eus	`10.0`
Linux	redhat	enterprise_linux_for_ibm_z_systems	`9.6_s390x`
Linux	redhat	enterprise_linux_for_ibm_z_systems	`10.0_s390x`
Linux	redhat	enterprise_linux_for_ibm_z_systems	`8.0_s390x`
Linux	redhat	enterprise_linux_for_ibm_z_systems	`9.0_s390x`
Linux	redhat	enterprise_linux_for_ibm_z_systems	`9.4_s390x`
Linux	redhat	enterprise_linux_for_ibm_z_systems	`9.2_s390x`
Linux	redhat	enterprise_linux_for_ibm_z_systems_eus	`10.0_s390x`
Linux	redhat	enterprise_linux_for_power_little_endian	`9.4_ppc64le`
Linux	redhat	enterprise_linux_for_power_little_endian	`9.2_ppc64le`
Linux	redhat	enterprise_linux_for_power_little_endian	`9.6_ppc64le`
Linux	redhat	enterprise_linux_for_power_little_endian	`9.0_ppc64le`
Linux	redhat	enterprise_linux_for_power_little_endian	`10.0_ppc64le`
Linux	redhat	enterprise_linux_for_power_little_endian	`8.0_ppc64le`
Linux	redhat	enterprise_linux_for_power_little_endian_eus	`9.6_ppc64le`
Linux	redhat	enterprise_linux_for_power_little_endian_eus	`10.0_ppc64le`
Linux	redhat	enterprise_linux_for_x86_64	`10.0`

Weakness classes (CWE)

CWE-918Server-Side Request Forgery (SSRF)
Base
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Entry at MITRE CWE-918

References & sources

NVD (NIST)vuln/detail/CVE-2023-26464advisory
github.comapache/logging-log4j2package
lists.apache.orgthread/wkx6grrcjkh86crr49p4blc1v1nflj3tweb, Vendor advisory, Mailing list
security.netapp.comadvisory/ntap-20230505-0008web
security.netapp.comadvisory/ntap-20230505-0008
github.comdain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9web, x_refsource_CONFIRM, Vendor advisory
NVD (NIST)vuln/detail/CVE-2024-36124advisory
github.comdain/snappypackage
NVD (NIST)vuln/detail/CVE-2025-27817advisory
github.comapache/kafkapackage
kafka.apache.orgcve-listweb, Vendor advisory, Vendor advisory
openwall.comlists/oss-security/2025/06/09/1web, Mailing list, Third-party advisory
access.redhat.comRHSA-2026:0936Vendor advisory, x_refsource_REDHAT, Vendor advisory
access.redhat.comRHSA-2026:0975Vendor advisory, x_refsource_REDHAT, Vendor advisory
access.redhat.comRHSA-2026:0991Vendor advisory, x_refsource_REDHAT, Vendor advisory
access.redhat.comRHSA-2026:1323Vendor advisory, x_refsource_REDHAT, Vendor advisory
access.redhat.comRHSA-2026:1324Vendor advisory, x_refsource_REDHAT, Vendor advisory
access.redhat.comRHSA-2026:1326Vendor advisory, x_refsource_REDHAT, Vendor advisory
access.redhat.comRHSA-2026:1327Vendor advisory, x_refsource_REDHAT, Vendor advisory
access.redhat.comRHSA-2026:1465Vendor advisory, x_refsource_REDHAT, Vendor advisory

Linked CVEs

Linked CVEs

Medium	CVE-2025-8869	Fallback tar extraction in pip doesn't check symbolic links point to extraction directory	—	—
High	CVE-2025-7962	Eclipse Foundation Jakarta Mail: Improper Neutralization of Input Terminators	7.5	—
High	CVE-2025-69223	AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb	7.5	—
Medium	CVE-2025-68161	Apache Log4j Core: Missing TLS hostname verification in Socket appender	4.8	—
High	CVE-2025-58057	Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack	7.5	—
Medium	CVE-2025-48924	Apache Commons Lang: Uncontrolled Recursion	5.3	—
High	CVE-2025-27817	Apache Kafka Client: Arbitrary file read and SSRF vulnerability	7.5	—
High	CVE-2025-13601	Glib: integer overflow in in g_escape_uri_string()	7.7	—
Medium	CVE-2024-36124	iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash	5.3	—
High	CVE-2024-29371	Jose4j Project Jose4j: Improper Restriction of Security Token Assignment	7.5	—
High	CVE-2023-26464	Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender	7.5	—
High	CVE-2023-1436	Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray	7.5	—
High	CVE-2022-45688	Dromara HuTool: Out-of-bounds Write	7.5	—

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2025-27817"><img src="https://intel.neosec.eu/badge/cve/CVE-2025-27817.svg?lang=en" alt="CVE-2025-27817 – NEOSEC Intel" height="20"></a>