[jira] (KAFKA-21178) Allow kafka admin to disable some compression methods

["majialong (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-21178 ]


    majialong deleted comment on KAFKA-21178:
    -----------------------------------

was (Author: JIRAUSER310372):
Hi [~showuon] , if you're not working on this, I'd like to take it and open a KIP. 

> Allow kafka admin to disable some compression methods
> -----------------------------------------------------
>
>                 Key: KAFKA-21178
>                 URL: https://issues.apache.org/jira/browse/KAFKA-21178
>             Project: Kafka
>          Issue Type: Improvement
>            Reporter: Luke Chen
>            Priority: Major
>
> We've seen the snappy-java CVEs 
>  * CVE-2026-93452 ([snappy issue|https://github.com/xerial/snappy-java/issues/732])
>  * CVE-2026-90559 ([snappy issue|https://github.com/xerial/snappy-java/issues/728])
> Unfortunately, the snappy-java community seems to be not maintained anymore. 
> Moreover, the is [lz4-jave community|https://github.com/lz4/lz4-java] is not maintained anymore, either. Currently, we use the [forked repo|https://github.com/yawkat/lz4-java] created by a user (yawkat). The single user repository might enter the unmaintained state anytime.
>  
> proposal:
> To improve that, we can create a config to allow kafka admin to disable some compression methods when written. This way, we can avoid the bad users to attack kafka using these impacted compression methods.
> Note: we cannot get rid of these compression methods because the history log in kafka will not be able to be decompressed anymore.
>  
>  
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)