In general, Kafka has a 1-year support window, so currently we are
supporting 4.3, 4.2, and 4.1 release:
https://kafka.apache.org/community/downloads/#supported-releases
With the upcoming 4.4.0 release, 4.1 will drop out of the support window.
So it's very unlikely that we would ship another 3.9.x bug-fix release.
Given that 3.9 is the last release with ZK support, and upgrading to 4.x
requires to migrate to KRaft, there is a possibility that we might
maintain 3.9.x for a little longer than usual. However, officially 3.9
is not supported any longer, and the 3.9 and 4.0 release got archived
already: https://kafka.apache.org/community/downloads/#archived-releases
-Matthias
On 8/19/26 7:21 AM, Gergely Harmadás wrote:
Hi James,
I am not a project maintainer, just an enthusiastic contributor who
happened to have the same problem with lz4 :) There are some discussion
about a possible 3.9 release in this thread, so far no concrete plans
https://lists.apache.org/thread/bq27on99lf5b24d16zt5g5hnysd30c3w
Best regards,
Gergely
On Mon, 17 Aug 2026 at 13:54, JAMES JOSE <[email protected]> wrote:
Hello Gergely,
Any plan for patching 3.9.* release with fixed version of lz4-java ?
Regards,
James
-----Original Message-----
From: JAMES JOSE
Sent: 17 August 2026 16:10
To: '[email protected]' <[email protected]>
Subject: RE: [EXTERNAL] Re: CVE-2026-59949 – Impact on Kafka (lz4-java)
Thanks for the information.
Regards,
James
-----Original Message-----
From: Gergely Harmadás <[email protected]>
Sent: 14 August 2026 16:58
To: [email protected]
Subject: [EXTERNAL] Re: CVE-2026-59949 – Impact on Kafka (lz4-java)
Hi James,
The update to 1.11.1 was covered in KAFKA-20842 <
https://urldefense.proofpoint.com/v2/url?u=https-3A__issues.apache.org_jira_browse_KAFKA-2D20842&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=wFuRXeZ1jY-k5xudtTTZ60tgwyI060iX_RvaTA5osQs&m=1D8DzNrAXlo6oFOad6b3jmLZxFQNXN36k_qrhHmAnqsr_1M7DWODVs6nR5clcUX4&s=Rtskq3UpzxYUDRvG-RkTH59cAW9Z8_015-CxCexEG0M&e=
. The CVE fix will be included in the upcoming Kafka 4.4 release which is
targeted for September according to the Release Plan <
https://urldefense.proofpoint.com/v2/url?u=https-3A__cwiki.apache.org_confluence_spaces_KAFKA_pages_429064575_Release-2BPlan-2B4.4.0&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=wFuRXeZ1jY-k5xudtTTZ60tgwyI060iX_RvaTA5osQs&m=1D8DzNrAXlo6oFOad6b3jmLZxFQNXN36k_qrhHmAnqsr_1M7DWODVs6nR5clcUX4&s=sf7VZBPkv6KzQsEateGr841NKrq0epSCQO05WlzYBOA&e=
.
There was also a backport to the 4.3 branch which means the CVE fix will
be included in a subsequent release, but AFAIK there is no planned date yet
for 4.3.2.
As a side-note I have noticed there is new security release for lz4,
created KAFKA-20937 <
https://urldefense.proofpoint.com/v2/url?u=https-3A__issues.apache.org_jira_browse_KAFKA-2D20937&d=DwIFaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=wFuRXeZ1jY-k5xudtTTZ60tgwyI060iX_RvaTA5osQs&m=1D8DzNrAXlo6oFOad6b3jmLZxFQNXN36k_qrhHmAnqsr_1M7DWODVs6nR5clcUX4&s=1rC8kX7_JaOzD_UXptNGM7VeglnyMjTuXu0WympUDaU&e=
to track the update.
Best regards,
Gergely
On Thu, 13 Aug 2026 at 05:59, JAMES JOSE <[email protected]> wrote:
Hi Team,
As per the GitHub advisory for GHSA-xx22-p4ch-683r (CVE-2026-59949),
lz4-java versions up to and including 1.11.0 are affected, with the
issue fixed in version 1.11.1. GitHub Advisory – GHSA-xx22-p4ch-683r<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_adviso
ries_GHSA-2Dxx22-2Dp4ch-2D683r-3Futm-5Fsource-3Dchatgpt.com&d=DwIFaQ&c
=BSDicqBQBDjDI9RkVyTcHQ&r=wFuRXeZ1jY-k5xudtTTZ60tgwyI060iX_RvaTA5osQs&
m=1D8DzNrAXlo6oFOad6b3jmLZxFQNXN36k_qrhHmAnqsr_1M7DWODVs6nR5clcUX4&s=0
leyUvEfu72D5H17gecX__uM3pEjIrAPlZfVtSbZ0CI&e= >
We understand that the latest Kafka version currently uses
lz4-java-1.10.2.
Could you please confirm whether this means Kafka is affected by
CVE-2026-59949 and whether Kafka needs to be updated to use lz4-java
1.11.1 or later?
If a Kafka update is required, could you also let us know whether
there is a planned Kafka release that will include the fixed version,
and the expected release date?
Thanks,
James
