Kafka

Hi Team, As per the GitHub advisory for GHSA-xx22-p4ch-683r (CVE-2026-59949), lz4-java versions up to and including 1.11.0 are affected, with the issue fixed in version 1.11.1. GitHub Advisory – GHSA-xx22-p4ch-683r<https://github.com/advisories/GHSA-xx22-p4ch-683r?utm_source=chatgpt.com> We understand that the latest Kafka version currently uses lz4-java-1.10.2. Could you please confirm whether this means Kafka is affected by CVE-2026-59949 and whether Kafka needs to be updated to use lz4-java 1.11.1 or later? If a Kafka update is required, could you also let us know whether there is a planned Kafka release that will include the fixed version, and the expected release date? Thanks, James

Hi Tamar, Interesting problem! Kafka Streams is actually the only Kafka API I haven’t done extensive performance testing/benchmarking on over the years. A couple of thoughts to start with. Is this behaviour only obvious at increasing load? Do you have sufficient cluster resources, Kafka clients? For Kafka Streams I recall that increasing the partitions (and therefore having sufficient clients and cluster resources) is the only real scalability knob? And for Kafka Streams, windowing size and state store may impact scalability. We tried Kafka Streams a few years internally for aggregating performance data and found resource usage too high and scalability poor, and resorted to custom Kafka clients. I’ve talked about this at C/C a few years ago, and here’s a bog from the internal team: https://www.instaclustr.com/blog/the-introduction-of-apache-kafka-infrastructure/ Others have used alternative streams processing tech including Flink, ClickHouse, RisingWave, etc. ...

Hi Vivek, Apache Kafka 4.3.1 is already released and won't get changed after the fact. Our binaries are immutable. What I can tell you is that both branches, 4.2 and 4.3 contain the updated dependencies, so subsequent releases in these both version families will include it. At the time of writing this, there is no planned date yet for 4.3.2 or 4.2.2, sorry. Best, ------------------ Josep Prat Sr. Engineering Director - Streaming Services, Aiven josep.prat@aiven.io | +491715557497 | aiven.io Aiven Deutschland GmbH Rosenthaler Straße 43-45, 10178 Berlin Geschäftsführer: Oskari Saarenmaa, Kenneth Chen Amtsgericht Charlottenburg, HRB 209739 B On Mon, Jul 20, 2026, 14:45 Vivek Agarwal B <vivek.b.agarwal@ericsson.com> wrote: > Hi Josep, > > Please can you confirm when will the Apache kafka v4.2 and v4.3.1 will > backport to latest Jackson version where the mentioned CVEs are fixed. > Also what is the tentative date for release of...

Hi Josep, Please can you confirm when will the Apache kafka v4.2 and v4.3.1 will backport to latest Jackson version where the mentioned CVEs are fixed. Also what is the tentative date for release of v4.3.2. Regards Vivek -----Original Message----- From: Josep Prat via users <users@kafka.apache.org> Sent: 14 July 2026 18:10 To: users@kafka.apache.org Cc: Josep Prat <josep.prat@aiven.io> Subject: Re: FW: Kafka new version info with vulnerabilities fixes Hi Vivek, On June 25th, Apache Kafka 4.3.1 was released and is available for use Of the CVEs you mentioned: Kafka Core - CVE-2026-41115 -> Fixed in 4.3.1 (documentation update) OpenTelemetry - CVE-2026-39882 -> seems to refer to opentelemetry-go and we use opentelemetry-proto only - CVE-2026-41078 -> seems to refer to opentelemetry-dotnet, we use opentelemetry-proto only - CVE-2026-40894 -> seems to refer to opentelemetry-dotnet, we use opentelemetry-proto only - CVE-2026-44967 -...

Hi Vivek, On June 25th, Apache Kafka 4.3.1 was released and is available for use Of the CVEs you mentioned: Kafka Core - CVE-2026-41115 -> Fixed in 4.3.1 (documentation update) OpenTelemetry - CVE-2026-39882 -> seems to refer to opentelemetry-go and we use opentelemetry-proto only - CVE-2026-41078 -> seems to refer to opentelemetry-dotnet, we use opentelemetry-proto only - CVE-2026-40894 -> seems to refer to opentelemetry-dotnet, we use opentelemetry-proto only - CVE-2026-44967 -> seems to refer to opentelemetry-c++, we use opentelemetry-proto only JLine - GHSA-2r2c-cx56-8933 -> seems to refer to JLine-telnet. We don't use this submodule - GHSA-47qp-hqvx-6r3f -> seems to refer to JLine-telnet. We don't use this submodule - XRAY-1005950 and XRAY-1005951 -> these appear to be JFrog Xray internal database identifiers rather than CVEs, so we can't look them up publicly. Could you share the affected component and version fr...

Hello Team, Could you please confirm the plan to release a new Kafka version that includes fixes for vulnerabilities identified primarily in transient dependencies such as Jackson, JLine, OpenTelemetry and a few others? These are detected in kafka v4.3.0. Below is the list of identified vulnerabilities for reference: Kafka core CVE-2026-41115 OpenTelemetry CVE-2026-39882 CVE-2026-41078 CVE-2026-40894 CVE-2026-44967 JLine GHSA-2r2c-cx56-8933 GHSA-47qp-hqvx-6r3f XRAY-1005950 XRAY-1005951 Jackson - CVE-2026-54512 CVE-2026-54513 CVE-2026-54514 CVE-2026-54515 CVE-2026-54516 CVE-2026-54517 CVE-2026-54518 Regards Vivek

Hello Team, Could you please confirm the plan to release a new Kafka version that includes fixes for vulnerabilities identified primarily in transient dependencies such as Jackson, JLine, OpenTelemetry and a few others? These are detected in kafka v4.3.0. Below is the list of identified vulnerabilities for reference: Kafka core CVE-2026-41115 OpenTelemetry CVE-2026-39882 CVE-2026-41078 CVE-2026-40894 CVE-2026-44967 JLine GHSA-2r2c-cx56-8933 GHSA-47qp-hqvx-6r3f XRAY-1005950 XRAY-1005951 Jackson - CVE-2026-54512 CVE-2026-54513 CVE-2026-54514 CVE-2026-54515 CVE-2026-54516 CVE-2026-54517 CVE-2026-54518 Regards Vivek