You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by "Shubhi Gupta (Jira)" <ji...@apache.org> on 2026/09/02 10:16:00 UTC

[jira] [Created] (KAFKA-21020) Fix CVE-2026-56740: Upgrade jline from 3.30.16 to 4.2.1

Shubhi Gupta created KAFKA-21020:
------------------------------------

             Summary: Fix CVE-2026-56740: Upgrade jline from 3.30.16 to 4.2.1
                 Key: KAFKA-21020
                 URL: https://issues.apache.org/jira/browse/KAFKA-21020
             Project: Kafka
          Issue Type: Bug
            Reporter: Shubhi Gupta


A *High-severity vulnerability (CVE-2026-56740)* has been identified in {{org.jline:jline-remote-telnet}} versions prior to 4.2.1. The vulnerable jar ({{{}jline-3.30.4.jar{}}} / {{{}jline-3.30.16{}}}) is shipped inside the Kafka release tarball under {{{}/opt/kafka/libs/{}}}, exposing all Docker images built from that tarball to the vulnerability.

The fix upgrades {{org.jline}} to version *4.2.1* — the first release line in which {{jline-remote-telnet}} is patched — and replaces one deprecated API call that became a compile-time error under {{{}-Werror{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)