You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "mingyen066 (via GitHub)" <gi...@apache.org> on 2026/02/12 07:42:44 UTC
[PR] KAFKA-20168: Upgrade Jetty from 12.0.22 to 12.0.32 to fix CVE-2025-5115 (4.2) [kafka]
mingyen066 opened a new pull request, #21462:
URL: https://github.com/apache/kafka/pull/21462
Upgrade Jetty from 12.0.22 to 12.0.32 to address
[GHSA-mmxm-8w33-wc4h](https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h)
(MadeYouReset HTTP/2 DoS, CVSS 7.7 HIGH).
Note that https://github.com/advisories/GHSA-mmxm-8w33-wc4h only affects the
org.eclipse.jetty.http2:jetty-http2-common module. Kafka does not
depend on this module — its embedded Jetty servers (Connect RestServer
and Trogdor JsonRestServer) only use HTTP/1.1 via ServerConnector
without any HTTP2ServerConnectionFactory
configuration. As such, the attack vector is not applicable. This
upgrade from 12.0.22 to 12.0.32 is to keep the dependency up to date.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20168: Upgrade Jetty from 12.0.22 to 12.0.32 to fix CVE-2025-5115 (4.0) [kafka]
Posted by "viktorsomogyi (via GitHub)" <gi...@apache.org>.
viktorsomogyi merged PR #21462:
URL: https://github.com/apache/kafka/pull/21462
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20168: Upgrade Jetty from 12.0.22 to 12.0.32 to fix CVE-2025-5115 (4.0) [kafka]
Posted by "viktorsomogyi (via GitHub)" <gi...@apache.org>.
viktorsomogyi commented on PR #21462:
URL: https://github.com/apache/kafka/pull/21462#issuecomment-3891089071
@mingyen066 I attempted to resolve the conflict as I pushed another CVE fix in the meanwhile. Let's wait for this build, merge it when it finishes and I'll create another RC.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org