Python CA fallout, EDK II pre-boot RCE, Kafka CVEs

A certificate authority incident forced expedited updates across the Python packaging stack, while UEFI firmware and Apache Kafka drew multiple security advisories. The Kafka issues span authentication bypass, file disclosure, secret exposure, and several denial-of-service paths.

emSign CA removed from certifi after security incident

An oss-security notice informs Python users of a security incident involving the eMudhra emSign CA. The CA was removed from certifi, driving expedited updates to pip, Python, uv, and related tools so that PyPI traffic is not exposed to man-in-the-middle attacks.

Pre-boot RCE in EDK II PXE driver

CVE-2026-97631 discloses a pre-boot remote code execution flaw in the EDK II PXE driver. The issue is reachable via ICMP and affects widely used UEFI firmware before the operating system loads, giving it broad reach on systems that boot over the network.

Kafka skips JWT signature checks when JWKS URL is unset

Apache Kafka published CVE-2026-110985 for SASL/OAUTHBEARER. When the JWKS endpoint URL is not configured, the broker silently skips JWT signature verification, which allows forged tokens to be accepted.

Unauthorized Kafka file reads via IncrementalAlterConfigs

CVE-2026-112375 lets an unauthorized principal read arbitrary broker files through IncrementalAlterConfigs. Config validation runs before authorization checks, so the broker can expose file and environment content to callers that should not see it.

Kafka Connect secrets leaked via validate endpoint

CVE-2026-116593 is a moderate issue in Apache Kafka Connect. Configuration provider values are resolved and returned in plaintext through the public validation REST API endpoint, exposing secrets that were meant to stay server-side.

Unbounded memory DoS in Kafka deserializers

CVE-2026-111551 reports denial of service via unbounded memory allocation in Kafka Streams and client deserializers. Crafted input can drive excessive allocation on both clients and Streams applications.

Tagged-field amplification OOM in Kafka brokers

CVE-2026-111115 is an important-severity broker OutOfMemoryError. Unchecked tagged-field counts in flexible protocol request parsing amplify allocation and can exhaust broker memory.

PushTelemetry decompression DoS on Kafka brokers

CVE-2026-111073 covers PushTelemetry (KIP-714) metrics payloads that are decompressed without a size limit. Authenticated clients can trigger broker out-of-memory conditions through oversized compressed payloads.