[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042272#comment-18042272
]
Mickael Maison edited comment on KAFKA-19951 at 12/2/25 6:23 PM:
-----------------------------------------------------------------
Looking at the LZ4Factory.fastestInstance() method, it should return the native
implementation, not the Java implementation, on all platforms where the JNI
bindings are available.
The lz4-java JAR contains the following bindings:
{noformat}
├── darwin
│ ├── aarch64
│ └── x86_64
├── linux
│ ├── aarch64
│ ├── amd64
│ ├── i386
│ ├── ppc64le
│ └── s390x
└── win32
└── amd64
{noformat}
While Kafka does not publish a list of supported platforms, these bindings
cover the most used common platforms.
was (Author: mimaison):
Looking at the LZ4Factory.fastestInstance() method, it should return the native
implementation, not the Java implementation, on all platforms where the JNI
bindings are available.
The lz4-java JAR contains the following bindings:
{noformat}
├── darwin
│ │ │ ├── aarch64
│ │ │ └── x86_64
│ │ ├── linux
│ │ │ ├── aarch64
│ │ │ ├── amd64
│ │ │ ├── i386
│ │ │ ├── ppc64le
│ │ │ └── s390x
│ │ └── win32
│ │ └── amd64
{noformat}
While Kafka does not publish a list of supported platforms, these bindings
cover the most used common platforms.
> switch lz4-java to at.yawk.lz4 version due to CVE
> -------------------------------------------------
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
> Reporter: PJ Fanning
> Priority: Major
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
