Kafka

Hello Gergely, Any plan for patching 3.9.* release with fixed version of lz4-java ? Regards, James -----Original Message----- From: JAMES JOSE Sent: 17 August 2026 16:10 To: 'users@kafka.apache.org' <users@kafka.apache.org> Subject: RE: [EXTERNAL] Re: CVE-2026-59949 – Impact on Kafka (lz4-java) Thanks for the information. Regards, James -----Original Message----- From: Gergely Harmadás <harmadasg@gmail.com> Sent: 14 August 2026 16:58 To: users@kafka.apache.org Subject: [EXTERNAL] Re: CVE-2026-59949 – Impact on Kafka (lz4-java) Hi James, The update to 1.11.1 was covered in KAFKA-20842 <https://urldefense.proofpoint.com/v2/url?u=https-3A__issues.apache.org_jira_browse_KAFKA-2D20842&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=wFuRXeZ1jY-k5xudtTTZ60tgwyI060iX_RvaTA5osQs&m=1D8DzNrAXlo6oFOad6b3jmLZxFQNXN36k_qrhHmAnqsr_1M7DWODVs6nR5clcUX4&s=Rtskq3UpzxYUDRvG-RkTH59cAW9Z8_015-CxCexEG0M&e= >. The CVE fix will be includ...

Thanks for the information. Regards, James -----Original Message----- From: Gergely Harmadás <harmadasg@gmail.com> Sent: 14 August 2026 16:58 To: users@kafka.apache.org Subject: [EXTERNAL] Re: CVE-2026-59949 – Impact on Kafka (lz4-java) Hi James, The update to 1.11.1 was covered in KAFKA-20842 <https://urldefense.proofpoint.com/v2/url?u=https-3A__issues.apache.org_jira_browse_KAFKA-2D20842&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=wFuRXeZ1jY-k5xudtTTZ60tgwyI060iX_RvaTA5osQs&m=1D8DzNrAXlo6oFOad6b3jmLZxFQNXN36k_qrhHmAnqsr_1M7DWODVs6nR5clcUX4&s=Rtskq3UpzxYUDRvG-RkTH59cAW9Z8_015-CxCexEG0M&e= >. The CVE fix will be included in the upcoming Kafka 4.4 release which is targeted for September according to the Release Plan <https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_spaces_KAFKA_pages_429064575_Release-2BPlan-2B4.4.0&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=wFuRXeZ1jY-k5xudtTTZ60tgwyI060iX_RvaTA5osQs...

Hi James, The update to 1.11.1 was covered in KAFKA-20842 <https://issues.apache.org/jira/browse/KAFKA-20842>. The CVE fix will be included in the upcoming Kafka 4.4 release which is targeted for September according to the Release Plan <https://cwiki.apache.org/confluence/spaces/KAFKA/pages/429064575/Release+Plan+4.4.0>. There was also a backport to the 4.3 branch which means the CVE fix will be included in a subsequent release, but AFAIK there is no planned date yet for 4.3.2. As a side-note I have noticed there is new security release for lz4, created KAFKA-20937 <https://issues.apache.org/jira/browse/KAFKA-20937> to track the update. Best regards, Gergely On Thu, 13 Aug 2026 at 05:59, JAMES JOSE <jamejose@in.ibm.com> wrote: > Hi Team, > > As per the GitHub advisory for GHSA-xx22-p4ch-683r (CVE-2026-59949), > lz4-java versions up to and including 1.11.0 are affected, with the issue > fixed in version 1.11.1. GitHub A...

Hi Team, As per the GitHub advisory for GHSA-xx22-p4ch-683r (CVE-2026-59949), lz4-java versions up to and including 1.11.0 are affected, with the issue fixed in version 1.11.1. GitHub Advisory – GHSA-xx22-p4ch-683r<https://github.com/advisories/GHSA-xx22-p4ch-683r?utm_source=chatgpt.com> We understand that the latest Kafka version currently uses lz4-java-1.10.2. Could you please confirm whether this means Kafka is affected by CVE-2026-59949 and whether Kafka needs to be updated to use lz4-java 1.11.1 or later? If a Kafka update is required, could you also let us know whether there is a planned Kafka release that will include the fixed version, and the expected release date? Thanks, James

Hi Tamar, Interesting problem! Kafka Streams is actually the only Kafka API I haven’t done extensive performance testing/benchmarking on over the years. A couple of thoughts to start with. Is this behaviour only obvious at increasing load? Do you have sufficient cluster resources, Kafka clients? For Kafka Streams I recall that increasing the partitions (and therefore having sufficient clients and cluster resources) is the only real scalability knob? And for Kafka Streams, windowing size and state store may impact scalability. We tried Kafka Streams a few years internally for aggregating performance data and found resource usage too high and scalability poor, and resorted to custom Kafka clients. I’ve talked about this at C/C a few years ago, and here’s a bog from the internal team: https://www.instaclustr.com/blog/the-introduction-of-apache-kafka-infrastructure/ Others have used alternative streams processing tech including Flink, ClickHouse, RisingWave, etc. ...

Hi Vivek, Apache Kafka 4.3.1 is already released and won't get changed after the fact. Our binaries are immutable. What I can tell you is that both branches, 4.2 and 4.3 contain the updated dependencies, so subsequent releases in these both version families will include it. At the time of writing this, there is no planned date yet for 4.3.2 or 4.2.2, sorry. Best, ------------------ Josep Prat Sr. Engineering Director - Streaming Services, Aiven josep.prat@aiven.io | +491715557497 | aiven.io Aiven Deutschland GmbH Rosenthaler Straße 43-45, 10178 Berlin Geschäftsführer: Oskari Saarenmaa, Kenneth Chen Amtsgericht Charlottenburg, HRB 209739 B On Mon, Jul 20, 2026, 14:45 Vivek Agarwal B <vivek.b.agarwal@ericsson.com> wrote: > Hi Josep, > > Please can you confirm when will the Apache kafka v4.2 and v4.3.1 will > backport to latest Jackson version where the mentioned CVEs are fixed. > Also what is the tentative date for release of...

Hi Josep, Please can you confirm when will the Apache kafka v4.2 and v4.3.1 will backport to latest Jackson version where the mentioned CVEs are fixed. Also what is the tentative date for release of v4.3.2. Regards Vivek -----Original Message----- From: Josep Prat via users <users@kafka.apache.org> Sent: 14 July 2026 18:10 To: users@kafka.apache.org Cc: Josep Prat <josep.prat@aiven.io> Subject: Re: FW: Kafka new version info with vulnerabilities fixes Hi Vivek, On June 25th, Apache Kafka 4.3.1 was released and is available for use Of the CVEs you mentioned: Kafka Core - CVE-2026-41115 -> Fixed in 4.3.1 (documentation update) OpenTelemetry - CVE-2026-39882 -> seems to refer to opentelemetry-go and we use opentelemetry-proto only - CVE-2026-41078 -> seems to refer to opentelemetry-dotnet, we use opentelemetry-proto only - CVE-2026-40894 -> seems to refer to opentelemetry-dotnet, we use opentelemetry-proto only - CVE-2026-44967 -...