streams for Apache Kafka

The streams for Apache Kafka component is a massively scalable, distributed, and high-performance data streaming platform based on the Apache Kafka project. It offers a distributed backbone that allows microservices and other applications to share data with high throughput and low latency.

Download

Ecosystem Catalog

Browse the latest documentation

Release Notes for Streams for Apache Kafka 3.2 on OpenShiftRelease Information

Streams for Apache Kafka on OpenShift OverviewStreams for Apache Kafka on OpenShift

Using Streams for Apache Kafka on RHELStreams for Apache Kafka on RHEL

Using the Streams for Apache Kafka HTTP BridgeHTTP Bridge

Using the Streams for Apache Kafka ConsoleConsole

Deploying and Managing Streams for Apache Kafka Proxy on OpenShiftProxy

Developing Kafka client applicationsReference

View all product documentation

Latest security advisories

Severity	Advisory/CVE	Synopsis	Date
Severity Important	Advisory/CVECVE-2026-56862	Synopsis A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.	Date
Severity Important	Advisory/CVECVE-2026-56853	Synopsis A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.	Date
Severity Important	Advisory/CVECVE-2026-56860	Synopsis A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.	Date
Severity Important	Advisory/CVECVE-2026-56859	Synopsis A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.	Date
Severity Important	Advisory/CVECVE-2026-33818	Synopsis A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.	Date