Kafka

No updates... We are waiting for RC2. But today, a potentially new blocker bug was found... On 9/16/26 4:35 AM, Vivek Agarwal B wrote: > Hi Matthias, > > Do we now have a confirmed date for the formal release of Kafka 4.4.0? > > Regards > Vivek > > -----Original Message----- > From: Matthias J. Sax <mjsax@apache.org> > Sent: 10 September 2026 02:49 > To: users@kafka.apache.org; Vivek Agarwal B <vivek.b.agarwal@ericsson.com> > Cc: Ashish Verma V <ashish.v.verma@ericsson.com>; Mayank Maheshwari M <mayank.m.maheshwari@ericsson.com> > Subject: Re: Kafka 4.4.0 formal release date -- Important > > [You don't often get email from mjsax@apache.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > As an open source project, we don't have committed release dates. The page literally says "no earlier than": > > > meaning we expect ...

No updates... We are waiting for RC2. But today, a potentially new blocker bug was found... On 9/16/26 5:27 AM, Mayank Maheshwari M wrote: > Hi @Matthias J. Sax, > > Unfortunately, I have not been able to follow the development mailing list to monitor the progress, as you suggested, due to security constraints at Ericsson. > > I understand that you previously mentioned the Kafka release may require approximately two more weeks. As noted in my last email, we have a release delivery scheduled for the end of September. Therefore, I would like to check whether you see a possibility of having the Kafka release available within that timeframe. > > I really appreciate your response and support on this. > > //Mayank > > -----Original Message----- > From: Vivek Agarwal B <vivek.b.agarwal@ericsson.com> > Sent: 16 September 2026 05:05 PM > To: Matthias J. Sax <mjsax@apache.org>; users@kafka.apache.org > Cc: Ashish ...

Hi @Matthias J. Sax, Unfortunately, I have not been able to follow the development mailing list to monitor the progress, as you suggested, due to security constraints at Ericsson. I understand that you previously mentioned the Kafka release may require approximately two more weeks. As noted in my last email, we have a release delivery scheduled for the end of September. Therefore, I would like to check whether you see a possibility of having the Kafka release available within that timeframe. I really appreciate your response and support on this. //Mayank -----Original Message----- From: Vivek Agarwal B <vivek.b.agarwal@ericsson.com> Sent: 16 September 2026 05:05 PM To: Matthias J. Sax <mjsax@apache.org>; users@kafka.apache.org Cc: Ashish Verma V <ashish.v.verma@ericsson.com>; Mayank Maheshwari M <mayank.m.maheshwari@ericsson.com> Subject: RE: Kafka 4.4.0 formal release date -- Important Hi Matthias, Do we now have a confirmed date for t...

Hi Matthias, Do we now have a confirmed date for the formal release of Kafka 4.4.0? Regards Vivek -----Original Message----- From: Matthias J. Sax <mjsax@apache.org> Sent: 10 September 2026 02:49 To: users@kafka.apache.org; Vivek Agarwal B <vivek.b.agarwal@ericsson.com> Cc: Ashish Verma V <ashish.v.verma@ericsson.com>; Mayank Maheshwari M <mayank.m.maheshwari@ericsson.com> Subject: Re: Kafka 4.4.0 formal release date -- Important [You don't often get email from mjsax@apache.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] As an open source project, we don't have committed release dates. The page literally says "no earlier than": > meaning we expect to release no earlier than September 9 2026 The AK 4.4.0 release is in code freeze, and a first RC was cut. But some blocker bugs were found, and need to be fixed before the next RC can be prepared. If you want to monitor the progre...

Hello Kafka Team, Below are the vulnerabilities which are identified in Jetty v12.0.37. They are fixed in jetty version 12.0.38. Kafka 4.4.0 rc still uses Jetty 12.0.37, could you please confirm if the formal kafka 4.4.0 release will upgrade the jetty version to 12.0.38? * CVE-2026-12611 (HTTP/2 thread exhaustion DoS) * CVE-2026-19203 (HTTP Request Smuggling) * CVE-2026-19204 (WebSocket memory exhaustion DoS) Regards Vivek

There are 4 Jline related vulnerabilities which are fixed in jline version 3.30.17. Kafka 4.4.0 rc still on jline 3.30.16. Please confirm whether kakfa 4.4.0 formal release will have upgrade jline version. The vulnerabilities are - https://github.com/jline/jline3/security/advisories/GHSA-7h86-pjwh-gpqj https://github.com/jline/jline3/security/advisories/GHSA-m935-wqpj-pvp3 https://github.com/jline/jline3/security/advisories/GHSA-6r3w-6jpj-x5w6 https://github.com/jline/jline3/security/advisories/GHSA-c87g-867h-cqr6 Regards Vivek

Hello Apache Kafka Team, In our product, kafka v4.3.0 is used. Below 3 Jli zstd-jni related vulnerabilities are reported on this kafka version - CVE-2026-87795 CVE-2026-87823 CVE-2026-87825 I see in Kafka 4.4.0 rc, zstd: "1.5.6-10" is included. However the fix for these 3 vulnerabilities is in Fixed version: 1.5.7-14 and later. Please confirm whether kafka 4.4.0 formal release will have fix for these vulnerabilities? Regards Vivek