CVE-2024-56128
Severity
5.3MEDIUM
EPSS
0.4%
top 40.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 18
Latest updateJul 15
Description
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation.
Issue Summary:
Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1].
Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message.
However, Kafka's SCRAM implementation did not perform this validatio…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages6 packages
🔴Vulnerability Details
3CVEList▶
Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption↗2024-12-18
📋Vendor Advisories
3Oracle▶
Oracle Oracle Communications Applications Risk Matrix: Common Functions (Apache Kafka) — CVE-2024-56128↗2025-07-15
Oracle▶
Oracle Oracle Communications Applications Risk Matrix: Platform (Apache Kafka) — CVE-2024-56128↗2025-04-15
Red Hat▶
kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption↗2024-12-18