You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by "Mangesh Dushman (Jira)" <ji...@apache.org> on 2026/07/31 14:12:00 UTC

[jira] [Commented] (KAFKA-20871) Upgrade Jetty 12.0.34 dependencies in Kafka to address multiple security vulnerabilities

    [ https://issues.apache.org/jira/browse/KAFKA-20871?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18100793#comment-18100793 ] 

Mangesh Dushman commented on KAFKA-20871:
-----------------------------------------

[~mimaison]  could you please share if there is an estimated timeline for the *Kafka 4.3.2* release?

Thanks,
Mangesh

> Upgrade Jetty 12.0.34 dependencies in Kafka to address multiple security vulnerabilities
> ----------------------------------------------------------------------------------------
>
>                 Key: KAFKA-20871
>                 URL: https://issues.apache.org/jira/browse/KAFKA-20871
>             Project: Kafka
>          Issue Type: Bug
>    Affects Versions: 4.3.1
>            Reporter: Mangesh Dushman
>            Priority: Major
>
> The Kafka component currently includes Jetty *12.0.34* libraries that are affected by the following security vulnerabilities:
> ||CVE||Component||Current Version||
> |CVE-2026-6790|jetty-server|12.0.34|
> |CVE-2026-10050|jetty-security|12.0.34|
> |CVE-2026-10051|jetty-server|12.0.34|
> |CVE-2026-8384|jetty-util|12.0.34|



--
This message was sent by Atlassian Jira
(v8.20.10#820010)