Kafka

Severity: low Affected versions: - Apache Kafka 2.8.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later. Credit: Mike Read (GitHub: Michael-JRead) (reporter) Kevin Wu <kwu@confluent.io> (remediation developer) References: https://github.com/apache/kafka/pull/23185 https://kafka.apache.org/cve-list https://www.cve.org/CVERecord?id=CVE-2026-83525

The Apache Kafka community is pleased to announce the release for Apache Kafka 4.3.2 This is a bugfix release in the 4.3 line. It fixes around 60 issues since the 4.3.1 release, most notably two potential data loss issues in tiered storage size-based retention and time index truncation, along with dependency updates addressing published CVEs in jackson-databind, lz4-java, log4j and Jetty. All of the changes in this release can be found in the release notes: https://downloads.apache.org/kafka/4.3.2/RELEASE_NOTES.html An overview of the release can be found in our announcement blog post: https://kafka.apache.org/blog/2026/10/23/apache-kafka-4.3.2-release-announcement/ You can download the source and binary release (Scala 2.13) from: https://kafka.apache.org/community/downloads/#432 --------------------------------------------------------------------------------------------------- Apache Kafka is a distributed streaming platform with four core APIs: ** Th...

Hi Chia-Ping, The plan sounds good to me. Since the document is really outdated, should we also backport it to older supported releases like 4.3 and 4.2, what do you think? Thanks, Gergely On Tue, 27 Oct 2026 at 03:48, Chia-Ping Tsai <chia7712@apache.org> wrote: > I haven’t looked at the PR yet: https://github.com/apache/kafka/pull/23907 > > Doc fixes don’t need to wait for a release. Once the PR gets merged, we > can file a patch to kafka-site to update the web site right away :) > > On 2026/10/21 22:01:28 Gergely Harmadás wrote: > > Hi Alexander, > > > > I also went through the docs and indeed it contains outdated > > information which can prevent you from setting up Kafka with SSL. I have > > opened KAFKA-21329 <https://issues.apache.org/jira/browse/KAFKA-21329> > to > > work on updating the docs. It likely won't reach the official docs site > > until the release of Kafka 4.5...

I haven’t looked at the PR yet: https://github.com/apache/kafka/pull/23907 Doc fixes don’t need to wait for a release. Once the PR gets merged, we can file a patch to kafka-site to update the web site right away :) On 2026/10/21 22:01:28 Gergely Harmadás wrote: > Hi Alexander, > > I also went through the docs and indeed it contains outdated > information which can prevent you from setting up Kafka with SSL. I have > opened KAFKA-21329 <https://issues.apache.org/jira/browse/KAFKA-21329> to > work on updating the docs. It likely won't reach the official docs site > until the release of Kafka 4.5 which is still months away. In the meantime > you can check out my patch at kafka/pull/23907 > <https://github.com/apache/kafka/pull/23907> and hopefully it can unblock > you in your SSL setup work. Of course any feedback is welcome on the > updated steps :) > > Thanks, > Gergely > > On Mon, 19 Oct 2026 at 17...

Hello Kafka Community, We are investigating a recurring Kafka broker startup failure on Windows Server and would appreciate guidance from the Kafka maintainers and community. Environment * Apache Kafka: 4.0.1 * Operating system: Windows Server * Java: Eclipse Temurin JDK 17.0.18 * Metadata mode: KRaft, single-node combined broker/controller * Service management: NSSM * Kafka storage directory: D:\KafkaStorage * Configuration: D:\Kafka\config\kraft\server.properties Problem description Kafka repeatedly fails during startup while recovering KRaft metadata snapshots. The service manager reports the Windows service as Running or restarts the Java process, but Kafka does not successfully start its listeners. Ports 9092 and 9093 remain unavailable. The recurring exception is: java.nio.file.AccessDeniedException: D:\KafkaStorage\__cluster_metadata-0\00000000000004062214-0000001671.checkpoint.deleted The stack trace indicates that the exception occurs dur...

Hi Kafka community, Two weeks ago, I got a reply from the community that our steps for an in-place KRaft topology change from dedicated controllers (static quorum) to combined broker/controller nodes is feasible, but we have some further questions. Let's say we currently have a 6-broker + 3-dedicated-controller KRaft Kafka cluster, and we want to eventually sunset controllers 101, 102, 103 and use 1, 2, 3 as mixed-role (broker + controller) nodes. Current dedicated-controller topology: - Controllers: 101, 102, 103 with process.roles=controller - Brokers: 1, 2, 3, 4, 5, 6 with process.roles=broker - Current quorum: controller.quorum.voters=101@host1:9093,102@host2:9093,103@host3:9093 Target mixed-role topology: - Mixed-role nodes: 1, 2, 3 with process.roles=broker,controller - Broker nodes: 4, 5, 6 with process.roles=broker - Target quorum: controller.quorum.voters=1@host1:9093,2@host2:9093,3@host3:9093 Our questions: 1. Is stopping the whole Kafka clust...

+1 (non-binding). I used the staged binaries and Maven artifacts to run my smoke tests & the Strimzi tests. All seems to work fine. Thanks for running the release. Thanks & Regards Jakub On Sun, Oct 11, 2026 at 4:07 PM 黃竣陽 <s7133700@gmail.com> wrote: > Hello Kafka users, developers and client-developers, > > This is the fourth candidate for release of Apache Kafka 4.3.2. > > This is a bugfix release in 4.3 line. > > Release notes for the 4.3.2 release: > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc3/RELEASE_NOTES.html > <https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc/RELEASE_NOTES.html> > > Please download, test and vote by Wednesday, October 14th, 9am PT > > Kafka's KEYS file containing PGP keys we use to sign the release: > https://downloads.apache.org/kafka/KEYS > > * Release artifacts to be voted upon (source and binary): > https://dist.apache.org/repos/dist/dev/ka...