[
https://issues.apache.org/jira/browse/FLINK-39139?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rui Fan resolved FLINK-39139.
-----------------------------
Fix Version/s: 2.1.2
2.3.0
2.2.1
Assignee: Cameron
Resolution: Fixed
Merged to
* master 2.3.0 via: e9afe8bfc52fdd9b94193e789ca1b4ed73099560
* 2.2.1 via: 88a10d984d60cf03cb94a7fcd754fd5398e4fb4d
* 2.1.2 via: 7beaca7c2e70e92edb1ffc40079c0df1216ec9c4
> Update lz4-java to 1.10.3
> -------------------------
>
> Key: FLINK-39139
> URL: https://issues.apache.org/jira/browse/FLINK-39139
> Project: Flink
> Issue Type: Improvement
> Reporter: Cameron
> Assignee: Cameron
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.1.2, 2.3.0, 2.2.1
>
>
> lz4-java 1.8.0 has the following CVEs:
> * [CVE-2025-66566|https://www.cve.org/CVERecord?id=CVE-2025-66566]
> * [CVE-2025-12183|https://www.cve.org/CVERecord?id=CVE-2025-12183]
> Updating lz4-java to 1.10.3 resolves the CVE
> It has also been relocated to at.yawk.lz4
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
