Hi Ken, I agree with Chia-Ping, it's best to do another RC to include the Jackson issues.
Thanks, Bill On Thu, Oct 8, 2026 at 12:06 PM Chia-Ping Tsai <[email protected]> wrote: > Hi Ken > > Since you asked for suggestions about the CVE: I'd suggest rolling the > next RC to include those fixes. > > I understand it is boring to roll the rock over and over, but there are no > votes yet, so it is not too late. > > WDYT? > > Best, > Chia-Ping > > On 2026-10-08 11:46 UTC 黃竣陽 wrote: > > Hello Kafka users, developers and client-developers, > > > > This is the second candidate for release of Apache Kafka 4.3.2. > > > > This is a bugfix release in 4.3 line. > > > > Release notes for the 4.3.2 release: > > > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc1/RELEASE_NOTES.html > <https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc/RELEASE_NOTES.html> > > > > Please download, test and vote by Tuesday, October 13th, 9am PT > > > > Kafka's KEYS file containing PGP keys we use to sign the release: > > https://downloads.apache.org/kafka/KEYS > > > > * Release artifacts to be voted upon (source and binary): > > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc1/ < > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc/> > > > > * Docker release artifacts to be voted upon: > > apache/kafka:4.3.2-rc1 > > apache/kafka-native:4.3.2-rc1 > > > > * Maven artifacts to be voted upon: > > https://repository.apache.org/content/groups/staging/org/apache/kafka/ > > > > * Javadoc: > > > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc1/javadoc/index.html > > > > * Tag to be voted upon (off 4.3 branch) is the 4.3.2 tag: > > https://github.com/apache/kafka/releases/tag/4.3.2-rc1 > > > > * Documentation: > > https://kafka.apache.org/43/documentation.html > > > > * Protocol: > > https://kafka.apache.org/43/design/protocol > > > > * Successful CI builds for the 4.3 branch: > > Unit/integration tests: > https://github.com/apache/kafka/actions/runs/37632175708 > > System tests: https://jenkins.opensource4you.tw/job/kafka-e2e/967/ > > > > * Docker Image Github Actions Pipeline for 4.3 branch: > > Docker Build Test Pipeline (JVM): > https://github.com/apache/kafka/actions/runs/37769307897 > > Docker Build Test Pipeline (Native): > https://github.com/apache/kafka/actions/runs/37769370154 > > > > The native pipeline is green. The JVM pipeline reports four HIGH > findings, > > all denial-of-service issues in Jackson 2.21.6 and all fixed in 2.21.7: > > CVE-2026-89407, CVE-2026-89425 (jackson-core) CVE-2026-91776, > CVE-2026-91777 (jackson-databind) > > I have not picked up the Jackson bump for this bugfix release, but am > happy to roll another > > RC if the community prefers to include it. > > > > Thanks, > > Jiunn-Yang Huang >
