Skip to main content

Kafka jetty vulnerabilities fixes

Hello Kafka Team, Below are the vulnerabilities which are identified in Jetty v12.0.37. They are fixed in jetty version 12.0.38. Kafka 4.4.0 rc still uses Jetty 12.0.37, could you please confirm if the formal kafka 4.4.0 release will upgrade the jetty version to 12.0.38? * CVE-2026-12611 (HTTP/2 thread exhaustion DoS) * CVE-2026-19203 (HTTP Request Smuggling) * CVE-2026-19204 (WebSocket memory exhaustion DoS) Regards Vivek

Comments