[
https://issues.apache.org/jira/browse/KAFKA-21099?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123418#comment-18123418
]
Gergely Harmadás commented on KAFKA-21099:
------------------------------------------
Looks like the snappy update to v1.1.10.10 is incorporated in
https://issues.apache.org/jira/browse/KAFKA-21126
* [https://github.com/xerial/snappy-java/releases#release-v1.1.10.8]
* [https://github.com/xerial/snappy-java/releases#release-v1.1.10.9]
* [https://github.com/xerial/snappy-java/releases#release-v1.1.10.10]
> CVE-2026-90559 snappy-java vulnerability
> ----------------------------------------
>
> Key: KAFKA-21099
> URL: https://issues.apache.org/jira/browse/KAFKA-21099
> Project: Kafka
> Issue Type: Bug
> Components: security
> Affects Versions: 4.3.1
> Reporter: Joshua Wisniewski
> Priority: Major
>
> kafka-clients depends on snappy-java. snappy-java has CVE
> [https://nvd.nist.gov/vuln/detail/cve-2026-90559] There is no fixed version
> of snappy-java discussed but a proactive change to the code is recommended.
> Is there any intention to announce that these proactive changes have been
> made to kafka-clients to address this CVE?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
