Kafka

Severity: moderate Affected versions: - Apache Kafka 3.1.0 before 4.4.0 Description: A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer (iss) claim is verified only when sasl.oauthbearer.expected.issuer is set. When it is unset, a validly-signed token carrying the expected audience is accepted regardless of which issuer minted it. - An audience (aud) claim is required only when sasl.oauthbearer.expected.audience is set. When it is unset, a validly-signed token that omits the aud claim is accepted. (A token that carries an aud claim is still rejected when no expected audience is configured.) Both options default to unset and have been documented as optional (Importance LOW) since KIP-768 (3.1.0). Impact: The exposure is realizable mainly in deployments whose JWKS endpoint serves si...

Severity: low Affected versions: - Apache Kafka 2.8.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later. Credit: Mike Read (GitHub: Michael-JRead) (reporter) Kevin Wu <kwu@confluent.io> (remediation developer) References: https://github.com/apache/kafka/pull/23185 https://kafka.apache.org/cve-list https://www.cve.org/CVERecord?id=CVE-2026-83525

The Apache Kafka community is pleased to announce the release for Apache Kafka 4.3.2 This is a bugfix release in the 4.3 line. It fixes around 60 issues since the 4.3.1 release, most notably two potential data loss issues in tiered storage size-based retention and time index truncation, along with dependency updates addressing published CVEs in jackson-databind, lz4-java, log4j and Jetty. All of the changes in this release can be found in the release notes: https://downloads.apache.org/kafka/4.3.2/RELEASE_NOTES.html An overview of the release can be found in our announcement blog post: https://kafka.apache.org/blog/2026/10/23/apache-kafka-4.3.2-release-announcement/ You can download the source and binary release (Scala 2.13) from: https://kafka.apache.org/community/downloads/#432 --------------------------------------------------------------------------------------------------- Apache Kafka is a distributed streaming platform with four core APIs: ** Th...

Hi Chia-Ping, The plan sounds good to me. Since the document is really outdated, should we also backport it to older supported releases like 4.3 and 4.2, what do you think? Thanks, Gergely On Tue, 27 Oct 2026 at 03:48, Chia-Ping Tsai <chia7712@apache.org> wrote: > I haven’t looked at the PR yet: https://github.com/apache/kafka/pull/23907 > > Doc fixes don’t need to wait for a release. Once the PR gets merged, we > can file a patch to kafka-site to update the web site right away :) > > On 2026/10/21 22:01:28 Gergely Harmadás wrote: > > Hi Alexander, > > > > I also went through the docs and indeed it contains outdated > > information which can prevent you from setting up Kafka with SSL. I have > > opened KAFKA-21329 <https://issues.apache.org/jira/browse/KAFKA-21329> > to > > work on updating the docs. It likely won't reach the official docs site > > until the release of Kafka 4.5...

I haven’t looked at the PR yet: https://github.com/apache/kafka/pull/23907 Doc fixes don’t need to wait for a release. Once the PR gets merged, we can file a patch to kafka-site to update the web site right away :) On 2026/10/21 22:01:28 Gergely Harmadás wrote: > Hi Alexander, > > I also went through the docs and indeed it contains outdated > information which can prevent you from setting up Kafka with SSL. I have > opened KAFKA-21329 <https://issues.apache.org/jira/browse/KAFKA-21329> to > work on updating the docs. It likely won't reach the official docs site > until the release of Kafka 4.5 which is still months away. In the meantime > you can check out my patch at kafka/pull/23907 > <https://github.com/apache/kafka/pull/23907> and hopefully it can unblock > you in your SSL setup work. Of course any feedback is welcome on the > updated steps :) > > Thanks, > Gergely > > On Mon, 19 Oct 2026 at 17...

Hello Kafka Community, We are investigating a recurring Kafka broker startup failure on Windows Server and would appreciate guidance from the Kafka maintainers and community. Environment * Apache Kafka: 4.0.1 * Operating system: Windows Server * Java: Eclipse Temurin JDK 17.0.18 * Metadata mode: KRaft, single-node combined broker/controller * Service management: NSSM * Kafka storage directory: D:\KafkaStorage * Configuration: D:\Kafka\config\kraft\server.properties Problem description Kafka repeatedly fails during startup while recovering KRaft metadata snapshots. The service manager reports the Windows service as Running or restarts the Java process, but Kafka does not successfully start its listeners. Ports 9092 and 9093 remain unavailable. The recurring exception is: java.nio.file.AccessDeniedException: D:\KafkaStorage\__cluster_metadata-0\00000000000004062214-0000001671.checkpoint.deleted The stack trace indicates that the exception occurs dur...

Hi Kafka community, Two weeks ago, I got a reply from the community that our steps for an in-place KRaft topology change from dedicated controllers (static quorum) to combined broker/controller nodes is feasible, but we have some further questions. Let's say we currently have a 6-broker + 3-dedicated-controller KRaft Kafka cluster, and we want to eventually sunset controllers 101, 102, 103 and use 1, 2, 3 as mixed-role (broker + controller) nodes. Current dedicated-controller topology: - Controllers: 101, 102, 103 with process.roles=controller - Brokers: 1, 2, 3, 4, 5, 6 with process.roles=broker - Current quorum: controller.quorum.voters=101@host1:9093,102@host2:9093,103@host3:9093 Target mixed-role topology: - Mixed-role nodes: 1, 2, 3 with process.roles=broker,controller - Broker nodes: 4, 5, 6 with process.roles=broker - Target quorum: controller.quorum.voters=1@host1:9093,2@host2:9093,3@host3:9093 Our questions: 1. Is stopping the whole Kafka clust...