RE: Kafka jetty vulnerabilities fixes

Hello Kafka Team, I see there is already a JIRA item to upgrade jetty version to 12.0.39 is in resolved state. However this jira item is not tagged to any kafka release. So need a confirmation whether Kafka 4.4.0 will be using this upgraded jetty version. [KAFKA-21139] Update Jetty to 12.0.39 - ASF Jira<https://issues.apache.org/jira/browse/KAFKA-21139> Regards Vivek From: Vivek Agarwal B Sent: 15 September 2026 10:47 To: users@kafka.apache.org Cc: Ashish Verma V <ashish.v.verma@ericsson.com>; Mayank Maheshwari M <mayank.m.maheshwari@ericsson.com> Subject: Kafka jetty vulnerabilities fixes Hello Kafka Team, Below are the vulnerabilities which are identified in Jetty v12.0.37. They are fixed in jetty version 12.0.38. Kafka 4.4.0 rc still uses Jetty 12.0.37, could you please confirm if the formal kafka 4.4.0 release will upgrade the jetty version to 12.0.38? * CVE-2026-12611 (HTTP/2 thread exhaustion DoS) * CVE-2026-19203 (HTTP Request Smuggling) * CVE-2026-19204 (WebSocket memory exhaustion DoS) Regards Vivek