Hello Kafka Community,
I am currently running Apache Kafka kafka_2.12-3.9.2 in production and have
identified several CVEs that affect components in Kafka's dependency chain.
I would like to consult the community on two questions:
1. Do these CVEs have any impact on a running kafka_2.12-3.9.2 deployment?
2. Is there a plan to address these vulnerabilities in the next Kafka release,
and if so, when is the next release expected?
Below is the list of CVEs I have identified:
┌──────────────────────┬───────────────────────────────┬──────────────────────────────────────────────────┐
│ CVE ID │ Affected Component │ Description
│
├──────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-24281 │ Apache ZooKeeper │ CVSS 7.4 HIGH ―
ZKTrustManager falls back to │
│ │ │ reverse DNS for
hostname verification; fixed │
│ │ │ in ZK 3.8.6 / 3.9.5
│
├──────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-24308 │ Apache ZooKeeper │ CVSS 7.5 HIGH ―
Sensitive info exposed in │
│ │ │ client logs at INFO
level; fixed in ZK │
│ │ │ 3.8.6 / 3.9.5
│
├──────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-59949 │ lz4-java (yawkat) │ CVSS 6.5 MEDIUM ―
XXHash JNI does not │
│ │ │ validate
array/offset/length args; fixed │
│ │ │ in lz4-java 1.11.1
│
├──────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-45536 │ Netty │ CVSS 4.0 MEDIUM ― File
descriptor leak in │
│ │ │ Unix domain socket
recvFd; fixed in │
│ │ │ Netty 4.1.135.Final /
4.2.15.Final │
├──────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-56741 │ JLine3 │ CVSS 7.5 HIGH ― Telnet
NAWS DoS; fixed │
│ │ │ in JLine3 3.30.14
│
├──────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-56740 │ JLine3 │ CVSS 7.5 HIGH ― Telnet
NEW-ENVIRON OOM; │
│ │ │ fixed in JLine3
3.30.14 │
├──────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-10050 │ Eclipse Jetty │ CVSS 8.7 HIGH ― Digest
auth charset │
│ │ │ bypass; fix version
TBD │
└──────────────────────┴───────────────────────────────┴──────────────────────────────────────────────────┘
My questions:
1. Impact assessment: Do any of these CVEs affect a running
kafka_2.12-3.9.2 deployment? For example:
- Which lz4-java, Netty, JLine3, and Jetty versions does
kafka_2.12-3.9.2 depend on, and are they within the affected ranges?
- Are any of these vulnerabilities reachable in a standard Kafka
deployment configuration?
2. Upgrade roadmap: Is there a plan to update the affected dependency
versions in the next Kafka release? If so:
- Which release (e.g., 3.9.x patch or 4.0) will include the fixes?
- What is the estimated release timeframe?
Any guidance or pointers to relevant JIRA issues would be greatly
appreciated.
Thank you for your time and the great work on Kafka.
Best regards,
Dking
[email protected]
