You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@kafka.apache.org by "Mickael Maison (Jira)" <ji...@apache.org> on 2024/08/08 12:20:00 UTC

[jira] [Created] (KAFKA-17301) lz4-java is not maintained anymore

Mickael Maison created KAFKA-17301:
--------------------------------------

             Summary: lz4-java is not maintained anymore
                 Key: KAFKA-17301
                 URL: https://issues.apache.org/jira/browse/KAFKA-17301
             Project: Kafka
          Issue Type: Task
            Reporter: Mickael Maison


lz4-java has not made a release since June 2021. It still depends on lz4 1.9.3 which has a critical (however it does not seem exploitable in our case) CVE: [CVE-2021-3520|https://nvd.nist.gov/vuln/detail/CVE-2021-3520].





--
This message was sent by Atlassian Jira
(v8.20.10#820010)