[jira] [Assigned] (KAFKA-21178) Allow kafka admin to disable some compression methods

["Arnab Nandy (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KAFKA-21178?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Arnab Nandy reassigned KAFKA-21178:
-----------------------------------

    Assignee: Arnab Nandy

> Allow kafka admin to disable some compression methods
> -----------------------------------------------------
>
>                 Key: KAFKA-21178
>                 URL: https://issues.apache.org/jira/browse/KAFKA-21178
>             Project: Kafka
>          Issue Type: Improvement
>            Reporter: Luke Chen
>            Assignee: Arnab Nandy
>            Priority: Major
>
> We've seen the snappy-java CVEs 
>  * CVE-2026-93452 ([snappy issue|https://github.com/xerial/snappy-java/issues/732])
>  * CVE-2026-90559 ([snappy issue|https://github.com/xerial/snappy-java/issues/728])
>  * CVE-2026-93451 ([snappy issue|https://github.com/xerial/snappy-java/issues/729])
> Unfortunately, the snappy-java community seems to be not maintained anymore. 
> Moreover, the is [lz4-jave community|https://github.com/lz4/lz4-java] is not maintained anymore, either. Currently, we use the [forked repo|https://github.com/yawkat/lz4-java] created by a user (yawkat). The single user repository might enter the unmaintained state anytime.
>  
> proposal:
> To improve that, we can create a config to allow kafka admin to disable some compression methods when written. This way, we can avoid the bad users to attack kafka using these impacted compression methods.
> Note: we cannot get rid of these compression methods because the history log in kafka will not be able to be decompressed anymore.
>  
>  
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)