[
https://issues.apache.org/jira/browse/KAFKA-21178?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Arnab Nandy reassigned KAFKA-21178:
-----------------------------------
Assignee: Arnab Nandy
> Allow kafka admin to disable some compression methods
> -----------------------------------------------------
>
> Key: KAFKA-21178
> URL: https://issues.apache.org/jira/browse/KAFKA-21178
> Project: Kafka
> Issue Type: Improvement
> Reporter: Luke Chen
> Assignee: Arnab Nandy
> Priority: Major
>
> We've seen the snappy-java CVEs
> * CVE-2026-93452 ([snappy
> issue|https://github.com/xerial/snappy-java/issues/732])
> * CVE-2026-90559 ([snappy
> issue|https://github.com/xerial/snappy-java/issues/728])
> * CVE-2026-93451 ([snappy
> issue|https://github.com/xerial/snappy-java/issues/729])
> Unfortunately, the snappy-java community seems to be not maintained anymore.
> Moreover, the is [lz4-jave community|https://github.com/lz4/lz4-java] is not
> maintained anymore, either. Currently, we use the [forked
> repo|https://github.com/yawkat/lz4-java] created by a user (yawkat). The
> single user repository might enter the unmaintained state anytime.
>
> proposal:
> To improve that, we can create a config to allow kafka admin to disable some
> compression methods when written. This way, we can avoid the bad users to
> attack kafka using these impacted compression methods.
> Note: we cannot get rid of these compression methods because the history log
> in kafka will not be able to be decompressed anymore.
>
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
