You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kafka.apache.org by jy...@apache.org on 2026/10/11 02:21:49 UTC
(kafka) branch 4.3 updated: KAFKA-21174: Update lz4 to 1.11.4 (#23767)
This is an automated email from the ASF dual-hosted git repository.
m1a2st pushed a commit to branch 4.3
in repository https://gitbox.apache.org/repos/asf/kafka.git
The following commit(s) were added to refs/heads/4.3 by this push:
new 5404e508db0 KAFKA-21174: Update lz4 to 1.11.4 (#23767)
5404e508db0 is described below
commit 5404e508db0102de7b7a74f6859b80268eddc2e8
Author: Ken Huang <s7...@gmail.com>
AuthorDate: Sun Oct 11 10:21:42 2026 +0800
KAFKA-21174: Update lz4 to 1.11.4 (#23767)
Fix lz4 CVE for 4.3
- [CVE-2026-106451 —
OpenCVE](https://app.opencve.io/cve/CVE-2026-106451)
- [CVE-2026-106451 — GitLab
Advisory](https://advisories.gitlab.com/maven/at.yawk.lz4/lz4-java/CVE-2026-106451/)
- [CVE-2026-106451 —
cvereports](https://cvereports.com/reports/CVE-2026-106451)
Reviewers: PoAn Yang <pa...@apache.org>
---
LICENSE-binary | 2 +-
gradle/dependencies.gradle | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/LICENSE-binary b/LICENSE-binary
index f426e0651fa..b9f93cf608a 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -241,7 +241,7 @@ License Version 2.0:
- log4j-core-2.25.5
- log4j-slf4j-impl-2.25.5
- log4j-1.2-api-2.25.5
-- lz4-java-1.11.2
+- lz4-java-1.11.4
- maven-artifact-3.9.15
- metrics-core-2.2.0
- opentelemetry-proto-1.3.2-alpha
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index c615b2d5039..3a015449cea 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -113,7 +113,7 @@ versions += [
// When updating lz4 make sure the compression levels in org.apache.kafka.common.record.internal.CompressionType are still valid
// https://github.com/apache/kafka/blob/trunk/clients/src/main/java/org/apache/kafka/common/record/internal/CompressionType.java#L73-L74
// https://github.com/yawkat/lz4-java/blob/main/src/java/net/jpountz/lz4/LZ4Constants.java#L23-L24
- lz4: "1.11.2",
+ lz4: "1.11.4",
mavenArtifact: "3.9.15",
metrics: "2.2.0",
mockito: "5.20.0",