This is an automated email from the ASF dual-hosted git repository.
schofielaj pushed a commit to branch 4.1
in repository https://gitbox.apache.org/repos/asf/kafka.git
The following commit(s) were added to refs/heads/4.1 by this push:
new 36a3731fbde KAFKA-20168: Downgrade Jetty from 12.0.32 to 12.0.25 to
fix SLF4J 2.x incompatibility (4.1) (#21561)
36a3731fbde is described below
commit 36a3731fbde74da0d115dba2dfafd606968a7bf2
Author: Ming-Yen Chung <[email protected]>
AuthorDate: Tue Feb 24 21:46:32 2026 +0800
KAFKA-20168: Downgrade Jetty from 12.0.32 to 12.0.25 to fix SLF4J 2.x
incompatibility (4.1) (#21561)
Jetty 12.0.30+ introduced SLF4J 2.x fluent API usage
(`Logger.atDebug()`) which causes `NoSuchMethodError` at runtime since
Kafka still uses SLF4J 1.7.x. Downgrade to 12.0.25 which includes the
CVE-2025-5115 fix without the SLF4J 2.x incompatibility.
The issue was discovered and discussed in
https://github.com/apache/kafka/pull/21452#issuecomment-3943544053.
trunk: https://github.com/apache/kafka/pull/21559
---
LICENSE-binary | 20 ++++++++++----------
gradle/dependencies.gradle | 2 +-
2 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/LICENSE-binary b/LICENSE-binary
index ce9d8de0d24..cbf94b92098 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -226,16 +226,16 @@ License Version 2.0:
- jakarta.inject-api-2.0.1
- jakarta.validation-api-3.0.2
- javassist-3.30.2-GA
-- jetty-alpn-client-12.0.32
-- jetty-client-12.0.32
-- jetty-ee10-servlet-12.0.32
-- jetty-ee10-servlets-12.0.32
-- jetty-http-12.0.32
-- jetty-io-12.0.32
-- jetty-security-12.0.32
-- jetty-server-12.0.32
-- jetty-session-12.0.32
-- jetty-util-12.0.32
+- jetty-alpn-client-12.0.25
+- jetty-client-12.0.25
+- jetty-ee10-servlet-12.0.25
+- jetty-ee10-servlets-12.0.25
+- jetty-http-12.0.25
+- jetty-io-12.0.25
+- jetty-security-12.0.25
+- jetty-server-12.0.25
+- jetty-session-12.0.25
+- jetty-util-12.0.25
- jose4j-0.9.6
- jspecify-1.0.0
- log4j-api-2.25.3
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index dc9829b9f02..e5844bcd259 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -66,7 +66,7 @@ versions += [
jackson: "2.19.4",
jacoco: "0.8.13",
javassist: "3.30.2-GA",
- jetty: "12.0.32",
+ jetty: "12.0.25",
jersey: "3.1.10",
jline: "3.30.4",
jmh: "1.37",
