Kafka

Hello Kafka Team, Below are the vulnerabilities which are identified in Jetty v12.0.37. They are fixed in jetty version 12.0.38. Kafka 4.4.0 rc still uses Jetty 12.0.37, could you please confirm if the formal kafka 4.4.0 release will upgrade the jetty version to 12.0.38? * CVE-2026-12611 (HTTP/2 thread exhaustion DoS) * CVE-2026-19203 (HTTP Request Smuggling) * CVE-2026-19204 (WebSocket memory exhaustion DoS) Regards Vivek

There are 4 Jline related vulnerabilities which are fixed in jline version 3.30.17. Kafka 4.4.0 rc still on jline 3.30.16. Please confirm whether kakfa 4.4.0 formal release will have upgrade jline version. The vulnerabilities are - https://github.com/jline/jline3/security/advisories/GHSA-7h86-pjwh-gpqj https://github.com/jline/jline3/security/advisories/GHSA-m935-wqpj-pvp3 https://github.com/jline/jline3/security/advisories/GHSA-6r3w-6jpj-x5w6 https://github.com/jline/jline3/security/advisories/GHSA-c87g-867h-cqr6 Regards Vivek

Hello Apache Kafka Team, In our product, kafka v4.3.0 is used. Below 3 Jli zstd-jni related vulnerabilities are reported on this kafka version - CVE-2026-87795 CVE-2026-87823 CVE-2026-87825 I see in Kafka 4.4.0 rc, zstd: "1.5.6-10" is included. However the fix for these 3 vulnerabilities is in Fixed version: 1.5.7-14 and later. Please confirm whether kafka 4.4.0 formal release will have fix for these vulnerabilities? Regards Vivek

As an open source project, we don't have committed release dates. The page literally says "no earlier than": > meaning we expect to release no earlier than September 9 2026 The AK 4.4.0 release is in code freeze, and a first RC was cut. But some blocker bugs were found, and need to be fixed before the next RC can be prepared. If you want to monitor the progress more closely, you can follow the dev mailing list (or the corresponding email thread on the archive in case you don't want to subscribe). At this point, I would think we need _at least_ two more weeks... -Matthias On 9/8/26 9:52 PM, Mayank Maheshwari M via users wrote: > Hi Kafka Team, > > Appreciate your response to the email below. > > We have a release planned for the end of September and are planning to include this Kafka version with the vulnerability fixes in the release. > > //Mayank > > From: Vivek Agarwal B <vivek.b.agarwal@er...

There is no better date than given on the wiki page. As an open source project, we don't have committed release dates. The page literally says "no earlier than": > meaning we expect to release no earlier than September 9 2026 The AK 4.4.0 release is in code freeze, and a first RC was cut. But some blocker bugs were found, and need to be fixed before the next RC can be prepared. If you want to monitor the progress more closely, you can follow the dev mailing list (or the corresponding email thread on the archive in case you don't want to subscribe). At this point, I would think we need _at least_ two more weeks... -Matthias On 9/8/26 10:20 PM, Apoorva Maheshwari via users wrote: > Hello Team, > > The Kafka 4.4.0 is not yet released. Can you please give confirmation on the Kafka release date? > > As per Kafka's plan 9th September is the probable release date. > > Release Plan 4.4.0 - Apache Kafka - ...

Hi Kafka Team, Appreciate your response to the email below. We have a release planned for the end of September and are planning to include this Kafka version with the vulnerability fixes in the release. //Mayank From: Vivek Agarwal B <vivek.b.agarwal@ericsson.com> Sent: 08 September 2026 09:16 AM To: users@kafka.apache.org Cc: Ashish Verma V <ashish.v.verma@ericsson.com>; Mayank Maheshwari M <mayank.m.maheshwari@ericsson.com> Subject: Kafka 4.4.0 formal release date Hi, As per Release Plan 4.4.0 - Apache Kafka - Apache Software Foundation<https://cwiki.apache.org/confluence/spaces/KAFKA/pages/429064575/Release+Plan+4.4.0>, the formal release for Kafka 4.4.0 is planned for 9th Sep. Could you please confirm that the release date remains unchanged and that there are no updates to the current schedule? Regards Vivek

Hello Team, The Kafka 4.4.0 is not yet released. Can you please give confirmation on the Kafka release date? As per Kafka's plan 9th September is the probable release date. Release Plan 4.4.0 - Apache Kafka - Apache Software Foundation<https://cwiki.apache.org/confluence/spaces/KAFKA/pages/429064575/Release+Plan+4.4.0> Regards, Apoorva Maheshwari