Impacted versions:
- Confluent Platform < 7.5.16, 7.6.13, 7.7.11, 7.8.10, 7.9.9, 8.0.7, 8.1.5, 8.2.3, 8.3.1
Recommended action: .
- Confluent Platform customers should upgrade to the latest patched release versions
Issue:
The version of Netty bundled with Confluent Platform is affected by several vulnerabilities. Each relevant CVE is documented below, along with its impact on Confluent Platform, the preconditions required for exploitation, and its associated CVSS score.
CVE-2026-50020
Impacted Component: KsqlDB
Before parsing the first request-line, Netty's HttpObjectDecoder silently skips every byte for which Character.isISOControl(b) is true (0x00–0x1F and 0x7F), along with whitespace. RFC 9112 permits ignoring only empty CRLF lines, so this over-permissive parsing can desynchronize request boundaries between Netty and an upstream component.
Exploitation requires Netty to sit behind a front-end proxy that forwards such prepended bytes rather than stripping or rejecting them. On pipelined or multiplexed connections, an attacker can use the resulting boundary mismatch to smuggle an additional request past the front end, potentially bypassing access controls enforced there. The impact is to integrity only, no information disclosure is attributed to this issue.
CVSS: 5.3 (CVSS v3.1 Calculator)
CVE-2026-50560
Impacted Component: KsqlDB
An HTTP/2 client can send a SETTINGS frame advertising an abnormally small SETTINGS_MAX_HEADER_LIST_SIZE. When the Netty server subsequently attempts to send response headers that exceed this limit, header encoding fails, an exception is thrown, and the stream is reset. As with an HTTP/2 Rapid Reset attack, a client can issue requests in a loop to force continuous server-side exception handling, consuming CPU and memory and degrading availability. Exploitation requires the ability to establish an HTTP/2 connection to an affected endpoint.
CVSS: 5.3 (CVSS v3.1 Calculator)
CVE-2026-45416
Impacted Component: KsqlDB
SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello spans multiple records, immediately allocates a buffer of the declared size — up to 16 MiB — from just nine attacker-controlled bytes. The commonly-used SniHandler constructors disable the length guard (maxClientHelloLength=0) and schedule no handshake timeout, so each connection pins a large unpooled buffer until the channel closes. An attacker can exhaust memory with minimal bandwidth, before the TLS handshake completes and without authentication.
Exploitation requires Netty to be configured for SNI-based routing (SniHandler), which is not enabled by default in Confluent Platform. Where it is in use, constructing the handler with a non-zero maxClientHelloLength restores the guard.
CVSS: 7.5 (CVSS v3.1 Calculator)
CVE-2026-44893
Impacted Component: KsqlDB
While decoding a PROXY protocol v2 header, HAProxyMessage.readNextTLV() retains a slice of the pooled cumulation buffer before reading the SSL TLV's 1-byte client field and 4-byte verify field. If an attacker declares a TLV length below 5, those reads exceed the available bytes and an IndexOutOfBoundsException is thrown. HAProxyMessageDecoder catches only HAProxyProtocolException, so the exception propagates and the retained slice is never released. An attacker can repeat this on new connections to accumulate leaked buffers until memory is exhausted, degrading or halting service availability.
Exploitation requires Netty to be configured to accept PROXY protocol headers, which is not enabled by default in Confluent Platform.
CVSS: 7.5 (CVSS v3.1 Calculator)
CVE-2026-48059
Impacted Component: KsqlDB
Netty's PROXY protocol v2 codec leaks native or heap memory on every connection that carries a syntactically valid header containing nested PP2_TYPE_SSL TLVs at depth two or greater. The leak occurs on the successful parse path: no exception is thrown, the message is passed downstream, the decoder removes itself, and the application releases the HAProxyMessage normally — yet the release routine does not recurse into nested TLVs, so the reference count on the underlying pooled cumulation buffer never reaches zero and the buffer remains permanently pinned. An attacker can open connections repeatedly to accumulate pinned buffers until memory is exhausted, degrading or halting service availability.
The affected code path requires Netty to be configured to accept PROXY protocol headers, which is not enabled by default in Confluent Platform.
CVSS: 7.5 (CVSS v3.1 Calculator)
Remediation:
-
Confluent Platform
- This issue is resolved in the following versions of Confluent Platform: 7.5.16, 7.6.13, 7.7.11, 7.8.10, 7.9.9, 8.0.7, 8.1.5, 8.2.3, 8.3.1