Hi Vivek, The CVE was fixed in the scope of KAFKA-20815 <https://issues.apache.org/jira/browse/KAFKA-20815> and will be included in the upcoming 4.4 release. You can find my analysis about the CVE in this <https://issues.apache.org/jira/browse/KAFKA-20815?focusedCommentId=18097890&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-18097890> comment. Best regards, Gergely On Fri, 21 Aug 2026 at 08:22, Vivek Agarwal B via users < users@kafka.apache.org> wrote: > Hello Apache Kafka Team, > > In our product, kafka v4.3.0 is used. Below 2 Jline related > vulnerabilities are reported on this kafka version - > > CVE-2026-56740 > CVE-2026-56741 > > I see in kafka v4.3.0, jline-3.30.4.jar is present in the libs folder - > libs/jline-3.30.4.jar/META-INF/maven/org.jline/jline-remote-telnet/pom.xml. > > As per github advisory, these vulnerabilities are fixed in Jline v4.2.1 > versions. > [1] CVE-2026-56740 Official Advisory - > https://github.com/advisories/GHSA-47qp-hqvx-6r3f > [2] CVE-2026-56741 Official Advisory - > https://github.com/advisories/GHSA-2r2c-cx56-8933 > > Please confirm what apache kafka upcoming versions will upgrade to Jline > v.4.2.1. > > Regards > Vivek >
Comments
Post a Comment