[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042488#comment-18042488 ] Chia-Ping Tsai commented on KAFKA-19951: My intention is that we stick on the planned release cycle and update the download page documentation (kafka-site) via a patch > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > Fix For: 3.9.2, 4.2.0, 4.0.2, 4.1.2 > > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042486#comment-18042486
]
Chia-Ping Tsai commented on KAFKA-19951:
{quote}
I think that's largely true, except in some circumstances where users are using
custom class loaders [0]
{quote}
I checked the class LZ4JavaUnsafeSafeDecompressor and found it relies on
numerous unsafe APIs for array access. I believe this could impact a subset of
users who rely on custom classloaders. Since we are preparing the 3.9.2 and
4.2.0 releases, perhaps we should document this limitation to remind users in
these specific cases.
> switch lz4-java to at.yawk.lz4 version due to CVE
> -
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
>Reporter: PJ Fanning
>Priority: Major
> Fix For: 3.9.2, 4.2.0, 4.0.2, 4.1.2
>
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042461#comment-18042461 ] Mickael Maison commented on KAFKA-19951: +1 to porting to 3.9, 4.0, 4.1 and 4.2 > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > Fix For: 3.9.2, 4.2.0, 4.0.2, 4.1.2 > > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042364#comment-18042364
]
Chia-Ping Tsai commented on KAFKA-19951:
{quote}
So my assessment is Kafka pretty safe on Linux and very possibly/probably at
risk on Windows.
{quote}
IIRC, Windows is not officially supported by Apache Kafka. Therefore, it should
be fine to stick to the planned release cycle instead of making emergency
releases
> switch lz4-java to at.yawk.lz4 version due to CVE
> -
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
>Reporter: PJ Fanning
>Priority: Major
> Fix For: 3.9.2, 4.2.0, 4.0.2, 4.1.2
>
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042357#comment-18042357 ] PJ Fanning commented on KAFKA-19951: So if you use safeDecompressor on Linux, you can be pretty sure lz4 is installed by default so JNI will be used to use the native install. With Windows, lz4 is not installed by default. So safeDecompressor can return an instance that uses sun.misc.Unsafe and lz4-java has inadequate bounds checking. This is exactly why there is a CVE for this. So my assessment is Kafka pretty safe on Linux and very possibly/probably at risk on Windows. > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > Fix For: 3.9.2, 4.2.0, 4.0.2, 4.1.2 > > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042312#comment-18042312
]
Gaurav Narula commented on KAFKA-19951:
---
{quote}Looking at the LZ4Factory.fastestInstance() method, it should return the
native implementation, not the Java implementation, on all platforms where the
JNI bindings are available.
{quote}
I think that's largely true, except in some circumstances where users are using
custom class loaders
[[0]|https://github.com/lz4/lz4-java/commit/9e3c4aa2bfdee0fbd0ddcdcf11cb2aec7a847c99]
> switch lz4-java to at.yawk.lz4 version due to CVE
> -
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
>Reporter: PJ Fanning
>Priority: Major
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042278#comment-18042278 ] Mickael Maison commented on KAFKA-19951: Yes now that there is a supported and compatible alternative, we definitively want to switch to it. But I still think it's important to confidently determine whether Kafka is vulnerable or not. If it's vulnerable we need to do emergency releases. Otherwise we can probably document it and stick to our planned release cycle. That's not quite the same level of organizations/work. > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042273#comment-18042273 ] PJ Fanning commented on KAFKA-19951: The best solution is to change jar. I've done it in Apache Pekko with no problems and no complexity other than changing to build to use the new jar instead of the old one. > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042272#comment-18042272
]
Mickael Maison commented on KAFKA-19951:
Looking at the LZ4Factory.fastestInstance() method, it should return the native
implementation, not the Java implementation, on all platforms where the JNI
bindings are available.
The lz4-java JAR contains the following bindings:
{noformat}
├── darwin
│ │ │ ├── aarch64
│ │ │ └── x86_64
│ │ ├── linux
│ │ │ ├── aarch64
│ │ │ ├── amd64
│ │ │ ├── i386
│ │ │ ├── ppc64le
│ │ │ └── s390x
│ │ └── win32
│ │ └── amd64
{noformat}
While Kafka does not publish a list of supported platforms, these bindings
cover the most used common platforms.
> switch lz4-java to at.yawk.lz4 version due to CVE
> -
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
>Reporter: PJ Fanning
>Priority: Major
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[
https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042269#comment-18042269
]
Gaurav Narula commented on KAFKA-19951:
---
[~mimaison]
[https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183#h.npq9cnryj03m]
sheds more information.
{quote}lz4-java provides a matrix of compression and decompression algorithms:
* A JNI-based implementation based on the lz4 library
(LZ4Factory.nativeInstance(), LZ4Factory.fastestInstance())
* A Java implementation using the deprecated sun.misc.Unsafe API
(LZ4Factory.unsafeInstance(), LZ4Factory.fastestInstance(),
LZ4Factory.fastestJavaInstance())
* A Java implementation without sun.misc.Unsafe (LZ4Factory.safeInstance())
Each of these variants has:
* A "fast" decompressor
* A "safe" decompressor
* Compressors for various compression levels
The JNI "fast" decompressor is based on the LZ4_decompress_fast API of the lz4
C library. This function is deprecated because it lacks bounds checks and is
insecure on untrusted input. Other JNI-based APIs (the safe decompressor and
the compressors) are not vulnerable.
All Java-based implementations lack sufficient bounds checks. For the
sun.misc.Unsafe-based implementations, this can lead to denial of service and
information disclosure. For the normal Java implementations, this only leads to
ArrayIndexOutOfBoundsExceptions and is not a vulnerability.
{quote}
Kafka uses:
{{/clients/src/main/java/org/apache/kafka/common/compress/Lz4BlockInputStream.java:
private static final LZ4SafeDecompressor DECOMPRESSOR =
LZ4Factory.fastestInstance().safeDecompressor();}}
which I reckon is the Java implementation possibly returning the implementation
backed by {{sun.misc.Unsafe}} API and is therefore vulnerable. I'd appreciate a
second opinion as well though.
> switch lz4-java to at.yawk.lz4 version due to CVE
> -
>
> Key: KAFKA-19951
> URL: https://issues.apache.org/jira/browse/KAFKA-19951
> Project: Kafka
> Issue Type: Bug
> Components: compression
>Reporter: PJ Fanning
>Priority: Major
>
> https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
> https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code
> The fork jar is a drop in replacement (same package name as the original jar)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042197#comment-18042197 ] Mickael Maison commented on KAFKA-19951: [~omkreddy] [~chia7712] [~dajac] Do you agree with my assessment? > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042194#comment-18042194 ] PJ Fanning commented on KAFKA-19951: [~mimaison] thanks for the quick response and your thoughts seem reasonable to me > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (KAFKA-19951) switch lz4-java to at.yawk.lz4 version due to CVE
[ https://issues.apache.org/jira/browse/KAFKA-19951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18042192#comment-18042192 ] Mickael Maison commented on KAFKA-19951: I'm supportive to replace lz4-java as it's not maintained anymore. According to https://github.com/lz4/lz4-java/issues/233#issuecomment-3590188502, it seems at.yawk.lz4 is blessed as the community replacement by the lz4 project. Now regarding CVE‐2025‐12183, it seems the vulnerability is in the LZ4_decompress_fast() method from LZ4, which is exposed as LZ4JNIFastDecompressor in lz4-java. Kafka only uses LZ4SafeDecompressor and that only calls LZ4_decompress_safe(). So my initial assessment is that Kafka is not vulnerable. I'm not a security nor lz4 expert, so please correct me if I'm wrong or if you have any more information. Still it would be good to switch to a supported library as all code scanners will flag the lz4-java-1.8.0 as vulnerable even if Kafka is not affected. > switch lz4-java to at.yawk.lz4 version due to CVE > - > > Key: KAFKA-19951 > URL: https://issues.apache.org/jira/browse/KAFKA-19951 > Project: Kafka > Issue Type: Bug > Components: compression >Reporter: PJ Fanning >Priority: Major > > https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183 > https://github.com/search?q=repo%3Aapache%2Fkafka%20lz4-java&type=code > The fork jar is a drop in replacement (same package name as the original jar) -- This message was sent by Atlassian Jira (v8.20.10#820010)
