[jira] [Comment Edited] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042357#comment-18042357 ] PJ Fanning edited comment on KAFKA-19951 at 12/3/25 1:10 AM: - So if you use safeDecompressor on Linux, you can be pretty sure lz4 is installed by default so JNI will be used to use the native lz4 installation. With Windows, lz4 is not installed by default. So safeDecompressor can return an instance that uses sun.misc.Unsafe and lz4-java has inadequate bounds checking. This is exactly why there is a CVE for this. So my assessment is Kafka pretty safe on Linux and very possibly/probably at risk on Windows. was (Author: fanningpj): So if you use safeDecompressor on Linux, you can be pretty sure lz4 is installed by default so JNI will be used to use the native install. With Windows, lz4 is not installed by default. So safeDecompressor can return an instance that uses sun.misc.Unsafe and lz4-java has inadequate bounds checking. This is exactly why there is a CVE for this. So my assessment is Kafka pretty safe on Linux and very possibly/probably at risk on Windows. > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > Fix For: 3.9.2, 4.2.0, 4.0.2, 4.1.2 > > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Comment Edited] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042278#comment-18042278 ] Mickael Maison edited comment on KAFKA-19951 at 12/2/25 7:02 PM: - Yes, now that there is a supported and compatible alternative, we definitively want to switch to it. But I still think it's important to confidently determine whether Kafka is vulnerable or not. If it's vulnerable we need to do emergency releases. Otherwise we can probably document it and stick to our planned release cycle. That's not quite the same level of organization/work. was (Author: mimaison): Yes now that there is a supported and compatible alternative, we definitively want to switch to it. But I still think it's important to confidently determine whether Kafka is vulnerable or not. If it's vulnerable we need to do emergency releases. Otherwise we can probably document it and stick to our planned release cycle. That's not quite the same level of organizations/work. > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Comment Edited] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042272#comment-18042272
]
Mickael Maison edited comment on KAFKA-19951 at 12/2/25 6:35 PM:
-
Looking at the LZ4Factory.fastestInstance() method, it should return the native
implementation, not the Java implementation, on all platforms where the JNI
bindings are available.
The lz4-java JAR contains the following bindings:
{noformat}
├── darwin
│ ├── aarch64
│ └── x86_64
├── linux
│ ├── aarch64
│ ├── amd64
│ ├── i386
│ ├── ppc64le
│ └── s390x
└── win32
└── amd64
{noformat}
While Kafka does not publish a list of supported platforms, these bindings
cover the most used platforms.
was (Author: mimaison):
Looking at the LZ4Factory.fastestInstance() method, it should return the native
implementation, not the Java implementation, on all platforms where the JNI
bindings are available.
The lz4-java JAR contains the following bindings:
{noformat}
├── darwin
│ ├── aarch64
│ └── x86_64
├── linux
│ ├── aarch64
│ ├── amd64
│ ├── i386
│ ├── ppc64le
│ └── s390x
└── win32
└── amd64
{noformat}
While Kafka does not publish a list of supported platforms, these bindings
cover the most used common platforms.
> switch lz4-java to at.yawk.lz4 version due to CVE
> -
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
>Reporter: PJ Fanning
>Priority: Major
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
[jira] [Comment Edited] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042272#comment-18042272
]
Mickael Maison edited comment on KAFKA-19951 at 12/2/25 6:23 PM:
-
Looking at the LZ4Factory.fastestInstance() method, it should return the native
implementation, not the Java implementation, on all platforms where the JNI
bindings are available.
The lz4-java JAR contains the following bindings:
{noformat}
├── darwin
│ ├── aarch64
│ └── x86_64
├── linux
│ ├── aarch64
│ ├── amd64
│ ├── i386
│ ├── ppc64le
│ └── s390x
└── win32
└── amd64
{noformat}
While Kafka does not publish a list of supported platforms, these bindings
cover the most used common platforms.
was (Author: mimaison):
Looking at the LZ4Factory.fastestInstance() method, it should return the native
implementation, not the Java implementation, on all platforms where the JNI
bindings are available.
The lz4-java JAR contains the following bindings:
{noformat}
├── darwin
│ │ │ ├── aarch64
│ │ │ └── x86_64
│ │ ├── linux
│ │ │ ├── aarch64
│ │ │ ├── amd64
│ │ │ ├── i386
│ │ │ ├── ppc64le
│ │ │ └── s390x
│ │ └── win32
│ │ └── amd64
{noformat}
While Kafka does not publish a list of supported platforms, these bindings
cover the most used common platforms.
> switch lz4-java to at.yawk.lz4 version due to CVE
> -
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
>Reporter: PJ Fanning
>Priority: Major
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
