CVE-2026-128424

A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes matching /…/ regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as matching /orders\.v1/ is compiled as the regex orders.v1, which also matches unintended names such as ordersXv1, and character classes such as \d and \w lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.

A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes matching /…/ regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as matching /orders\.v1/ is compiled as the regex orders.v1, which also matches unintended names such as ordersXv1, and character classes such as \d and \w lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.

A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes matching /…/ regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as matching /orders\.v1/ is compiled as the regex orders.v1, which also matches unintended names such as ordersXv1, and character classes such as \d and \w lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.

A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes matching /…/ regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as matching /orders\.v1/ is compiled as the regex orders.v1, which also matches unintended names such as ordersXv1, and character classes such as \d and \w lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.