You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@kafka.apache.org by Apoorva Maheshwari via users <us...@kafka.apache.org> on 2026/02/11 05:00:18 UTC

Version info that supports Jetty v12.0.25

Hello Team,

Please confirm your plan to release a version that supports Jetty v12.0.25, in order to address Jetty CVE-2025-5115.

Regards,
Apoorva Maheshwari

Re: Version info that supports Jetty v12.0.25

Posted by Chia-Ping Tsai <ch...@apache.org>.

I've opened https://issues.apache.org/jira/browse/KAFKA-20168 to address it

Best,
Chia-Ping

On 2026/02/11 05:00:18 Apoorva Maheshwari via users wrote:
> Hello Team,
> 
> Please confirm your plan to release a version that supports Jetty v12.0.25, in order to address Jetty CVE-2025-5115.
> 
> Regards,
> Apoorva Maheshwari
> 
> 
>

RE: Version info that supports Jetty v12.0.25

Posted by Chia-Ping Tsai <ch...@apache.org>.

I had responded, and please check https://issues.apache.org/jira/browse/KAFKA-20168

On 2026/02/13 05:39:51 Apoorva Maheshwari via users wrote:
> Response awaited.
> 
> Regards,
> Apoorva Maheshwari
> 
> From: Apoorva Maheshwari
> Sent: 11 February 2026 10:30
> To: users-subscribe@kafka.apache.org; users@kafka.apache.org
> Cc: Abhishek Kant Rattan <ab...@ericsson.com>; Sahil Sharma D <sa...@ericsson.com>
> Subject: Version info that supports Jetty v12.0.25
> 
> Hello Team,
> 
> Please confirm your plan to release a version that supports Jetty v12.0.25, in order to address Jetty CVE-2025-5115.
> 
> Regards,
> Apoorva Maheshwari
> 
> 
>

RE: Version info that supports Jetty v12.0.25

Posted by Chia-Ping Tsai <ch...@apache.org>.

Version 12.0.25 will be included in the following Kafka releases:

4.3.0, 4.2.1, 4.0.2, 4.1.2, 3.9.3 

see https://issues.apache.org/jira/browse/KAFKA-20168


On 2026/03/16 03:08:35 Apoorva Maheshwari via users wrote:
> Hello,
> 
> CVE-2025-5115 is fixed in Jetty 12.0.25.
> Although, latest released Kafka 4.2.0 still have dependency on Jetty 12.0.22.
> Kindly let us know in which kakfa version, you are planning to take Jetty 12.0.25 or later.
> 
> Regards,
> Apoorva Maheshwari
> 
> From: Jim Halfpenny <ji...@stackable.tech>
> Sent: 12 March 2026 13:05
> To: Apoorva Maheshwari <ap...@ericsson.com>
> Cc: users@kafka.apache.org; Steven Schlansker <st...@gmail.com>; users-subscribe@kafka.apache.org; Abhishek Kant Rattan <ab...@ericsson.com>; Sahil Sharma D <sa...@ericsson.com>
> Subject: Re: Version info that supports Jetty v12.0.25
> 
> You don't often get email from jim.halfpenny@stackable.tech<ma...@stackable.tech>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
> Hi Apoorva,
> I made a typo in my email, I was referring to CVE-2025-5115. The short answer is upgrade to Kafka >= 4.1.0 to get a version of Jetty that addresses this issue.
> 
> Kind regards,
> Jim
> 
> 
> On 12 Mar 2026, at 07:17, Apoorva Maheshwari <ap...@ericsson.com>> wrote:
> 
> Hello Jim,
> 
> Thanks for the quick response.
> 
> But I need information about Jetty v12.0.25, in order to address Jetty CVE-2025-5115 not CVE-2025-5151.
> 
> 
> Also, if we see any compatibility concerns, with latest jetty and current Kafka will Kafka support that?
> 
> Regards,
> Apoorva Maheshwari
> 
> From: Jim Halfpenny <ji...@stackable.tech>>
> Sent: 11 March 2026 15:30
> To: users@kafka.apache.org<ma...@kafka.apache.org>
> Cc: Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Apoorva Maheshwari <ap...@ericsson.com>>
> Subject: Re: Version info that supports Jetty v12.0.25
> 
> You don't often get email from jim.halfpenny@stackable.tech<ma...@stackable.tech>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
> Hi Apoorva,
> I've looked through the Kafka dependencies in Github and 4.1.0 contains Jetty 12.0.22, which contains fixes to address CVE-2025-5151.
> 
> https://github.com/apache/kafka/blob/4.1.0/gradle/dependencies.gradle
> 
> Is this the information you need? If you are using Kafka 3.x I expect you will need to upgrade to 4.x to obtain this fix, I am guessing that jumping from Jetty 9 to 12 is too big a leap for a simple backport of this fix.
> 
> Kind regards,
> Jim
> 
> 
> 
> On Wed, 11 Mar 2026 at 06:54, Apoorva Maheshwari via users <us...@kafka.apache.org>> wrote:
> Hello,
> 
> Can you please share your plan for Jetty release?
> 
> Regards,
> Apoorva Maheshwari
> 
> -----Original Message-----
> From: Steven Schlansker <st...@gmail.com>>
> Sent: 26 February 2026 22:00
> To: users@kafka.apache.org<ma...@kafka.apache.org>
> Cc: users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Apoorva Maheshwari <ap...@ericsson.com>>
> Subject: Re: Version info that supports Jetty v12.0.25
> 
> [You don't often get email from stevenschlansker@gmail.com<ma...@gmail.com>. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> > On Feb 16, 2026, at 1:14 AM, Apoorva Maheshwari via users <us...@kafka.apache.org>> wrote:
> >
> > Hello Team,
> >
> > Can you please confirm this pattern, that when we get any vulnerability of jetty and fix from Jetty is available, how soon Kafka release a new version with this Jetty?
> 
> If you are urgently needing to adopt a Jetty release on your own schedule, rather than Kafka's schedule, you can always adopt new Jetty with your current Kafka version using Maven's <dependencyManagement> feature. This works for most projects, not just Kafka.
> 
> Of course then you should test that the new combination works acceptably to your requirements, but it at least gives you an independent path forward without needing to pressure Kafka maintainers on new releases with dependency updates, until the normal release process delivers a fixed Kafka artifact.
> 
> >
> > Regards,
> > Apoorva Maheshwari
> >
> > From: Apoorva Maheshwari
> > Sent: 13 February 2026 11:10
> > To: 'users-subscribe@kafka.apache.org<ma...@kafka.apache.org>'
> > <us...@kafka.apache.org>>; 'users@kafka.apache.org<ma...@kafka.apache.org>'
> > <us...@kafka.apache.org>>
> > Cc: Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil
> > Sharma D <sa...@ericsson.com>>
> > Subject: RE: Version info that supports Jetty v12.0.25
> >
> > Response awaited.
> >
> > Regards,
> > Apoorva Maheshwari
> >
> > From: Apoorva Maheshwari
> > Sent: 11 February 2026 10:30
> > To:
> > users-subscribe@kafka.apache.org<ma...@kafka.apache.o>
> > rg>; users@kafka.apache.org<ma...@kafka.apache.org>>
> > Cc: Abhishek Kant Rattan
> > <ab...@ericsso>
> > n.com<http://n.com/>>>; Sahil Sharma D
> > <sa...@ericsson.com>>>
> > Subject: Version info that supports Jetty v12.0.25
> >
> > Hello Team,
> >
> > Please confirm your plan to release a version that supports Jetty v12.0.25, in order to address Jetty CVE-2025-5115.
> >
> > Regards,
> > Apoorva Maheshwari
> >
> >
> 
>

RE: Version info that supports Jetty v12.0.25

Posted by Vivek Agarwal B via users <us...@kafka.apache.org>.

Hi Jim,

The product uses the latest kafka version i.e 4.2.0 wherein the jetty version used is still the old one 12.0.22
kafka/gradle/dependencies.gradle at 4.2.0 · apache/kafka · GitHub<https://github.com/apache/kafka/blob/4.2.0/gradle/dependencies.gradle>

Regards
Vivek

From: Ashish Verma V <as...@ericsson.com>
Sent: 24 March 2026 14:02
To: Jim Halfpenny <ji...@stackable.tech>
Cc: users@kafka.apache.org; Steven Schlansker <st...@gmail.com>; users-subscribe@kafka.apache.org; Abhishek Kant Rattan <ab...@ericsson.com>; Sahil Sharma D <sa...@ericsson.com>; Apoorva Maheshwari <ap...@ericsson.com>; Vivek Agarwal B <vi...@ericsson.com>
Subject: RE: Version info that supports Jetty v12.0.25

++ Vivek

From: Jim Halfpenny <ji...@stackable.tech>>
Sent: 21 March 2026 15:09
To: Ashish Verma V <as...@ericsson.com>>
Cc: users@kafka.apache.org<ma...@kafka.apache.org>; Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Apoorva Maheshwari <ap...@ericsson.com>>
Subject: Re: Version info that supports Jetty v12.0.25

If you look at the dependancies for 4.0.2 and 4.1.2 you can see that Jetty 12.0.25 is present there.

https://github.com/apache/kafka/blob/4.0.2/gradle/dependencies.gradle
https://github.com/apache/kafka/blob/4.1.2/gradle/dependencies.gradle

Kind regards,
JIm

On 20 Mar 2026, at 05:21, Ashish Verma V <as...@ericsson.com>> wrote:

Hi Jim,

Any update on this query.

Thanks
Ashish Verma
From: Apoorva Maheshwari <ap...@ericsson.com>>
Sent: 16 March 2026 08:39
To: Jim Halfpenny <ji...@stackable.tech>>
Cc: users@kafka.apache.org<ma...@kafka.apache.org>; Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Ashish Verma V <as...@ericsson.com>>
Subject: RE: Version info that supports Jetty v12.0.25

Hello,

CVE-2025-5115 is fixed in Jetty 12.0.25.
Although, latest released Kafka 4.2.0 still have dependency on Jetty 12.0.22.
Kindly let us know in which kakfa version, you are planning to take Jetty 12.0.25 or later.

Regards,
Apoorva Maheshwari

From: Jim Halfpenny <ji...@stackable.tech>>
Sent: 12 March 2026 13:05
To: Apoorva Maheshwari <ap...@ericsson.com>>
Cc: users@kafka.apache.org<ma...@kafka.apache.org>; Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>
Subject: Re: Version info that supports Jetty v12.0.25

You don't often get email from jim.halfpenny@stackable.tech<ma...@stackable.tech>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hi Apoorva,
I made a typo in my email, I was referring to CVE-2025-5115. The short answer is upgrade to Kafka >= 4.1.0 to get a version of Jetty that addresses this issue.

Kind regards,
Jim

On 12 Mar 2026, at 07:17, Apoorva Maheshwari <ap...@ericsson.com>> wrote:

Hello Jim,

Thanks for the quick response.

But I need information about Jetty v12.0.25, in order to address Jetty CVE-2025-5115 not CVE-2025-5151.

Also, if we see any compatibility concerns, with latest jetty and current Kafka will Kafka support that?

Regards,
Apoorva Maheshwari

From: Jim Halfpenny <ji...@stackable.tech>>
Sent: 11 March 2026 15:30
To: users@kafka.apache.org<ma...@kafka.apache.org>
Cc: Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Apoorva Maheshwari <ap...@ericsson.com>>
Subject: Re: Version info that supports Jetty v12.0.25

You don't often get email from jim.halfpenny@stackable.tech<ma...@stackable.tech>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hi Apoorva,
I've looked through the Kafka dependencies in Github and 4.1.0 contains Jetty 12.0.22, which contains fixes to address CVE-2025-5151.

https://github.com/apache/kafka/blob/4.1.0/gradle/dependencies.gradle

Is this the information you need? If you are using Kafka 3.x I expect you will need to upgrade to 4.x to obtain this fix, I am guessing that jumping from Jetty 9 to 12 is too big a leap for a simple backport of this fix.

Kind regards,
Jim

On Wed, 11 Mar 2026 at 06:54, Apoorva Maheshwari via users <us...@kafka.apache.org>> wrote:
Hello,

Can you please share your plan for Jetty release?

Regards,
Apoorva Maheshwari

-----Original Message-----
From: Steven Schlansker <st...@gmail.com>>
Sent: 26 February 2026 22:00
To: users@kafka.apache.org<ma...@kafka.apache.org>
Cc: users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Apoorva Maheshwari <ap...@ericsson.com>>
Subject: Re: Version info that supports Jetty v12.0.25

[You don't often get email from stevenschlansker@gmail.com<ma...@gmail.com>. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

> On Feb 16, 2026, at 1:14 AM, Apoorva Maheshwari via users <us...@kafka.apache.org>> wrote:
>
> Hello Team,
>
> Can you please confirm this pattern, that when we get any vulnerability of jetty and fix from Jetty is available, how soon Kafka release a new version with this Jetty?

If you are urgently needing to adopt a Jetty release on your own schedule, rather than Kafka's schedule, you can always adopt new Jetty with your current Kafka version using Maven's <dependencyManagement> feature. This works for most projects, not just Kafka.

Of course then you should test that the new combination works acceptably to your requirements, but it at least gives you an independent path forward without needing to pressure Kafka maintainers on new releases with dependency updates, until the normal release process delivers a fixed Kafka artifact.

>
> Regards,
> Apoorva Maheshwari
>
> From: Apoorva Maheshwari
> Sent: 13 February 2026 11:10
> To: 'users-subscribe@kafka.apache.org<ma...@kafka.apache.org>'
> <us...@kafka.apache.org>>; 'users@kafka.apache.org<ma...@kafka.apache.org>'
> <us...@kafka.apache.org>>
> Cc: Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil
> Sharma D <sa...@ericsson.com>>
> Subject: RE: Version info that supports Jetty v12.0.25
>
> Response awaited.
>
> Regards,
> Apoorva Maheshwari
>
> From: Apoorva Maheshwari
> Sent: 11 February 2026 10:30
> To:
> users-subscribe@kafka.apache.org<ma...@kafka.apache.o>
> rg>; users@kafka.apache.org<ma...@kafka.apache.org>>
> Cc: Abhishek Kant Rattan
> <ab...@ericsso>
> n.com<http://n.com/>>>; Sahil Sharma D
> <sa...@ericsson.com>>>
> Subject: Version info that supports Jetty v12.0.25
>
> Hello Team,
>
> Please confirm your plan to release a version that supports Jetty v12.0.25, in order to address Jetty CVE-2025-5115.
>
> Regards,
> Apoorva Maheshwari
>
>

RE: Version info that supports Jetty v12.0.25

Posted by Ashish Verma V via users <us...@kafka.apache.org>.

++ Vivek

From: Jim Halfpenny <ji...@stackable.tech>
Sent: 21 March 2026 15:09
To: Ashish Verma V <as...@ericsson.com>
Cc: users@kafka.apache.org; Steven Schlansker <st...@gmail.com>; users-subscribe@kafka.apache.org; Abhishek Kant Rattan <ab...@ericsson.com>; Sahil Sharma D <sa...@ericsson.com>; Apoorva Maheshwari <ap...@ericsson.com>
Subject: Re: Version info that supports Jetty v12.0.25

If you look at the dependancies for 4.0.2 and 4.1.2 you can see that Jetty 12.0.25 is present there.

https://github.com/apache/kafka/blob/4.0.2/gradle/dependencies.gradle
https://github.com/apache/kafka/blob/4.1.2/gradle/dependencies.gradle

Kind regards,
JIm

On 20 Mar 2026, at 05:21, Ashish Verma V <as...@ericsson.com>> wrote:

Hi Jim,

Any update on this query.

Thanks
Ashish Verma
From: Apoorva Maheshwari <ap...@ericsson.com>>
Sent: 16 March 2026 08:39
To: Jim Halfpenny <ji...@stackable.tech>>
Cc: users@kafka.apache.org<ma...@kafka.apache.org>; Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Ashish Verma V <as...@ericsson.com>>
Subject: RE: Version info that supports Jetty v12.0.25

Hello,

CVE-2025-5115 is fixed in Jetty 12.0.25.
Although, latest released Kafka 4.2.0 still have dependency on Jetty 12.0.22.
Kindly let us know in which kakfa version, you are planning to take Jetty 12.0.25 or later.

Regards,
Apoorva Maheshwari

From: Jim Halfpenny <ji...@stackable.tech>>
Sent: 12 March 2026 13:05
To: Apoorva Maheshwari <ap...@ericsson.com>>
Cc: users@kafka.apache.org<ma...@kafka.apache.org>; Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>
Subject: Re: Version info that supports Jetty v12.0.25

You don't often get email from jim.halfpenny@stackable.tech<ma...@stackable.tech>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hi Apoorva,
I made a typo in my email, I was referring to CVE-2025-5115. The short answer is upgrade to Kafka >= 4.1.0 to get a version of Jetty that addresses this issue.

Kind regards,
Jim

On 12 Mar 2026, at 07:17, Apoorva Maheshwari <ap...@ericsson.com>> wrote:

Hello Jim,

Thanks for the quick response.

But I need information about Jetty v12.0.25, in order to address Jetty CVE-2025-5115 not CVE-2025-5151.

Also, if we see any compatibility concerns, with latest jetty and current Kafka will Kafka support that?

Regards,
Apoorva Maheshwari

From: Jim Halfpenny <ji...@stackable.tech>>
Sent: 11 March 2026 15:30
To: users@kafka.apache.org<ma...@kafka.apache.org>
Cc: Steven Schlansker <st...@gmail.com>>; users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Apoorva Maheshwari <ap...@ericsson.com>>
Subject: Re: Version info that supports Jetty v12.0.25

You don't often get email from jim.halfpenny@stackable.tech<ma...@stackable.tech>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hi Apoorva,
I've looked through the Kafka dependencies in Github and 4.1.0 contains Jetty 12.0.22, which contains fixes to address CVE-2025-5151.

https://github.com/apache/kafka/blob/4.1.0/gradle/dependencies.gradle

Is this the information you need? If you are using Kafka 3.x I expect you will need to upgrade to 4.x to obtain this fix, I am guessing that jumping from Jetty 9 to 12 is too big a leap for a simple backport of this fix.

Kind regards,
Jim

On Wed, 11 Mar 2026 at 06:54, Apoorva Maheshwari via users <us...@kafka.apache.org>> wrote:
Hello,

Can you please share your plan for Jetty release?

Regards,
Apoorva Maheshwari

-----Original Message-----
From: Steven Schlansker <st...@gmail.com>>
Sent: 26 February 2026 22:00
To: users@kafka.apache.org<ma...@kafka.apache.org>
Cc: users-subscribe@kafka.apache.org<ma...@kafka.apache.org>; Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil Sharma D <sa...@ericsson.com>>; Apoorva Maheshwari <ap...@ericsson.com>>
Subject: Re: Version info that supports Jetty v12.0.25

[You don't often get email from stevenschlansker@gmail.com<ma...@gmail.com>. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

> On Feb 16, 2026, at 1:14 AM, Apoorva Maheshwari via users <us...@kafka.apache.org>> wrote:
>
> Hello Team,
>
> Can you please confirm this pattern, that when we get any vulnerability of jetty and fix from Jetty is available, how soon Kafka release a new version with this Jetty?

If you are urgently needing to adopt a Jetty release on your own schedule, rather than Kafka's schedule, you can always adopt new Jetty with your current Kafka version using Maven's <dependencyManagement> feature. This works for most projects, not just Kafka.

Of course then you should test that the new combination works acceptably to your requirements, but it at least gives you an independent path forward without needing to pressure Kafka maintainers on new releases with dependency updates, until the normal release process delivers a fixed Kafka artifact.

>
> Regards,
> Apoorva Maheshwari
>
> From: Apoorva Maheshwari
> Sent: 13 February 2026 11:10
> To: 'users-subscribe@kafka.apache.org<ma...@kafka.apache.org>'
> <us...@kafka.apache.org>>; 'users@kafka.apache.org<ma...@kafka.apache.org>'
> <us...@kafka.apache.org>>
> Cc: Abhishek Kant Rattan <ab...@ericsson.com>>; Sahil
> Sharma D <sa...@ericsson.com>>
> Subject: RE: Version info that supports Jetty v12.0.25
>
> Response awaited.
>
> Regards,
> Apoorva Maheshwari
>
> From: Apoorva Maheshwari
> Sent: 11 February 2026 10:30
> To:
> users-subscribe@kafka.apache.org<ma...@kafka.apache.o>
> rg>; users@kafka.apache.org<ma...@kafka.apache.org>>
> Cc: Abhishek Kant Rattan
> <ab...@ericsso>
> n.com<http://n.com/>>>; Sahil Sharma D
> <sa...@ericsson.com>>>
> Subject: Version info that supports Jetty v12.0.25
>
> Hello Team,
>
> Please confirm your plan to release a version that supports Jetty v12.0.25, in order to address Jetty CVE-2025-5115.
>
> Regards,
> Apoorva Maheshwari
>
>

Re: Version info that supports Jetty v12.0.25

Posted by Jim Halfpenny via users <us...@kafka.apache.org>.

If you look at the dependancies for 4.0.2 and 4.1.2 you can see that Jetty 12.0.25 is present there.

https://github.com/apache/kafka/blob/4.0.2/gradle/dependencies.gradle
https://github.com/apache/kafka/blob/4.1.2/gradle/dependencies.gradle

Kind regards,
JIm

> On 20 Mar 2026, at 05:21, Ashish Verma V <as...@ericsson.com> wrote:
> 
> Hi Jim,
>  
> Any update on this query.
>  
> Thanks
> Ashish Verma
> From: Apoorva Maheshwari <ap...@ericsson.com>
> Sent: 16 March 2026 08:39
> To: Jim Halfpenny <ji...@stackable.tech>
> Cc: users@kafka.apache.org; Steven Schlansker <st...@gmail.com>; users-subscribe@kafka.apache.org; Abhishek Kant Rattan <ab...@ericsson.com>; Sahil Sharma D <sa...@ericsson.com>; Ashish Verma V <as...@ericsson.com>
> Subject: RE: Version info that supports Jetty v12.0.25
>  
> Hello,
>  
> CVE-2025-5115 is fixed in Jetty 12.0.25.
> Although, latest released Kafka 4.2.0 still have dependency on Jetty 12.0.22.
> Kindly let us know in which kakfa version, you are planning to take Jetty 12.0.25 or later.
>  
> Regards,
> Apoorva Maheshwari
>  
> From: Jim Halfpenny <jim.halfpenny@stackable.tech <ma...@stackable.tech>>
> Sent: 12 March 2026 13:05
> To: Apoorva Maheshwari <apoorva.maheshwari@ericsson.com <ma...@ericsson.com>>
> Cc: users@kafka.apache.org <ma...@kafka.apache.org>; Steven Schlansker <stevenschlansker@gmail.com <ma...@gmail.com>>; users-subscribe@kafka.apache.org <ma...@kafka.apache.org>; Abhishek Kant Rattan <abhishek.kant.rattan@ericsson.com <ma...@ericsson.com>>; Sahil Sharma D <sahil.d.sharma@ericsson.com <ma...@ericsson.com>>
> Subject: Re: Version info that supports Jetty v12.0.25
>  
> You don't often get email from jim.halfpenny@stackable.tech <ma...@stackable.tech>. Learn why this is important <https://aka.ms/LearnAboutSenderIdentification>	
> Hi Apoorva, 
> I made a typo in my email, I was referring to CVE-2025-5115. The short answer is upgrade to Kafka >= 4.1.0 to get a version of Jetty that addresses this issue.
>  
> Kind regards,
> Jim
>  
> 
> On 12 Mar 2026, at 07:17, Apoorva Maheshwari <apoorva.maheshwari@ericsson.com <ma...@ericsson.com>> wrote:
>  
> Hello Jim,
>  
> Thanks for the quick response.
>  
> But I need information about Jetty v12.0.25, in order to address Jetty CVE-2025-5115 not CVE-2025-5151.
>  
>  
> Also, if we see any compatibility concerns, with latest jetty and current Kafka will Kafka support that?
>  
> Regards,
> Apoorva Maheshwari
>  
> From: Jim Halfpenny <jim.halfpenny@stackable.tech <ma...@stackable.tech>>
> Sent: 11 March 2026 15:30
> To: users@kafka.apache.org <ma...@kafka.apache.org>
> Cc: Steven Schlansker <stevenschlansker@gmail.com <ma...@gmail.com>>; users-subscribe@kafka.apache.org <ma...@kafka.apache.org>; Abhishek Kant Rattan <abhishek.kant.rattan@ericsson.com <ma...@ericsson.com>>; Sahil Sharma D <sahil.d.sharma@ericsson.com <ma...@ericsson.com>>; Apoorva Maheshwari <apoorva.maheshwari@ericsson.com <ma...@ericsson.com>>
> Subject: Re: Version info that supports Jetty v12.0.25
>  
> You don't often get email from jim.halfpenny@stackable.tech <ma...@stackable.tech>. Learn why this is important <https://aka.ms/LearnAboutSenderIdentification>	
> Hi Apoorva, 
> I've looked through the Kafka dependencies in Github and 4.1.0 contains Jetty 12.0.22, which contains fixes to address CVE-2025-5151.
>  
> https://github.com/apache/kafka/blob/4.1.0/gradle/dependencies.gradle
>  
> Is this the information you need? If you are using Kafka 3.x I expect you will need to upgrade to 4.x to obtain this fix, I am guessing that jumping from Jetty 9 to 12 is too big a leap for a simple backport of this fix.
>  
> Kind regards,
> Jim
>  
>  
>  
> On Wed, 11 Mar 2026 at 06:54, Apoorva Maheshwari via users <users@kafka.apache.org <ma...@kafka.apache.org>> wrote:
> Hello,
> 
> Can you please share your plan for Jetty release?
> 
> Regards,
> Apoorva Maheshwari
> 
> -----Original Message-----
> From: Steven Schlansker <stevenschlansker@gmail.com <ma...@gmail.com>>
> Sent: 26 February 2026 22:00
> To: users@kafka.apache.org <ma...@kafka.apache.org>
> Cc: users-subscribe@kafka.apache.org <ma...@kafka.apache.org>; Abhishek Kant Rattan <abhishek.kant.rattan@ericsson.com <ma...@ericsson.com>>; Sahil Sharma D <sahil.d.sharma@ericsson.com <ma...@ericsson.com>>; Apoorva Maheshwari <apoorva.maheshwari@ericsson.com <ma...@ericsson.com>>
> Subject: Re: Version info that supports Jetty v12.0.25
> 
> [You don't often get email from stevenschlansker@gmail.com <ma...@gmail.com>. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> > On Feb 16, 2026, at 1:14 AM, Apoorva Maheshwari via users <users@kafka.apache.org <ma...@kafka.apache.org>> wrote:
> >
> > Hello Team,
> >
> > Can you please confirm this pattern, that when we get any vulnerability of jetty and fix from Jetty is available, how soon Kafka release a new version with this Jetty?
> 
> If you are urgently needing to adopt a Jetty release on your own schedule, rather than Kafka's schedule, you can always adopt new Jetty with your current Kafka version using Maven's <dependencyManagement> feature. This works for most projects, not just Kafka.
> 
> Of course then you should test that the new combination works acceptably to your requirements, but it at least gives you an independent path forward without needing to pressure Kafka maintainers on new releases with dependency updates, until the normal release process delivers a fixed Kafka artifact.
> 
> >
> > Regards,
> > Apoorva Maheshwari
> >
> > From: Apoorva Maheshwari
> > Sent: 13 February 2026 11:10
> > To: 'users-subscribe@kafka.apache.org <ma...@kafka.apache.org>'
> > <users-subscribe@kafka.apache.org <ma...@kafka.apache.org>>; 'users@kafka.apache.org <ma...@kafka.apache.org>'
> > <users@kafka.apache.org <ma...@kafka.apache.org>>
> > Cc: Abhishek Kant Rattan <abhishek.kant.rattan@ericsson.com <ma...@ericsson.com>>; Sahil
> > Sharma D <sahil.d.sharma@ericsson.com <ma...@ericsson.com>>
> > Subject: RE: Version info that supports Jetty v12.0.25
> >
> > Response awaited.
> >
> > Regards,
> > Apoorva Maheshwari
> >
> > From: Apoorva Maheshwari
> > Sent: 11 February 2026 10:30
> > To: 
> > users-subscribe@kafka.apache.org <ma...@kafka.apache.org><mailto:users-subscribe@kafka.apache.o <ma...@kafka.apache.o>
> > rg>; users@kafka.apache.org <ma...@kafka.apache.org><mailto:users@kafka.apache.org <ma...@kafka.apache.org>>
> > Cc: Abhishek Kant Rattan 
> > <abhishek.kant.rattan@ericsson.com <ma...@ericsson.com><mailto:abhishek.kant.rattan@ericsso <ma...@ericsso>
> > n.com <http://n.com/>>>; Sahil Sharma D 
> > <sahil.d.sharma@ericsson.com <ma...@ericsson.com><mailto:sahil.d.sharma@ericsson.com <ma...@ericsson.com>>>
> > Subject: Version info that supports Jetty v12.0.25
> >
> > Hello Team,
> >
> > Please confirm your plan to release a version that supports Jetty v12.0.25, in order to address Jetty CVE-2025-5115.
> >
> > Regards,
> > Apoorva Maheshwari
> >
> >
>