You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kafka.apache.org by mi...@apache.org on 2026/09/29 08:56:37 UTC

(kafka) branch 4.2 updated: MINOR: Backport docs to 4.2.2 upgrade notes (#23618)

This is an automated email from the ASF dual-hosted git repository.

apoorvmittal10 pushed a commit to branch 4.2
in repository https://gitbox.apache.org/repos/asf/kafka.git


The following commit(s) were added to refs/heads/4.2 by this push:
     new 42dd988512a MINOR: Backport docs to 4.2.2 upgrade notes (#23618)
42dd988512a is described below

commit 42dd988512ab42995ebce44a80b9532d91365b62
Author: Apoorv Mittal <ap...@gmail.com>
AuthorDate: Tue Sep 29 09:56:30 2026 +0100

    MINOR: Backport docs to 4.2.2 upgrade notes (#23618)
    
    Backport the protocol message reader allocation-limit upgrade note from
    #23565 to the 4.2.2.
    
    Reviewers: Andrew Schofield <as...@confluent.io>
---
 docs/getting-started/upgrade.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/getting-started/upgrade.md b/docs/getting-started/upgrade.md
index e0e903a417a..94a2aabd10a 100644
--- a/docs/getting-started/upgrade.md
+++ b/docs/getting-started/upgrade.md
@@ -38,6 +38,7 @@ type: docs
 * Includes a fix for a high CPU loop on the consumer after a failed re-authentication ([KAFKA-20253](https://issues.apache.org/jira/browse/KAFKA-20253)).
 * Includes a fix for consumer groups accepting new classic-protocol members even when `group.consumer.migration.policy=disabled`, which could leave a group permanently stuck in a mixed-protocol state ([KAFKA-20640](https://issues.apache.org/jira/browse/KAFKA-20640)).
 * Includes a fix for `AdminClient` APIs routed through the partition-leader cache (`listOffsets`, `deleteRecords`, `describeProducers`, `abortTransaction`) blocking for the full `default.api.timeout.ms` instead of failing fast when a cached leader has left the cluster ([KAFKA-20673](https://issues.apache.org/jira/browse/KAFKA-20673)).
+* Protocol message readers now limit array and collection allocations when decoding messages. Arrays and collections with more than 1,000,000 elements and flexible-version tagged-field sections with more than 10,000 fields are rejected before allocation. Arrays and collections are initially allocated with a capacity no greater than 1,000 and grow as needed during decoding.
 * Bumped jackson-databind ([KAFKA-21004](https://issues.apache.org/jira/browse/KAFKA-21004), [KAFKA-20773](https://issues.apache.org/jira/browse/KAFKA-20773), [KAFKA-20767](https://issues.apache.org/jira/browse/KAFKA-20767)), lz4-java ([KAFKA-20936](https://issues.apache.org/jira/browse/KAFKA-20936)), and jline ([KAFKA-20815](https://issues.apache.org/jira/browse/KAFKA-20815)) to address reported CVEs.
 
 ## Upgrading to 4.2.1