[
https://issues.apache.org/jira/browse/KAFKA-21020?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18115248#comment-18115248
]
Matthias J. Sax commented on KAFKA-21020:
-----------------------------------------
Hmmm... Is this ticket correct, saying
{quote}The vulnerable jar ({{{}jline-3.30.4.jar{}}} / {{{}jline-3.30.16{}}})
{quote}
It seems this was fixed with 3.30.15 release already:
[https://nvd.nist.gov/vuln/detail/cve-2026-56740]
> Fix CVE-2026-56740: Upgrade jline from 3.30.16 to 4.2.1
> -------------------------------------------------------
>
> Key: KAFKA-21020
> URL: https://issues.apache.org/jira/browse/KAFKA-21020
> Project: Kafka
> Issue Type: Bug
> Reporter: Shubhi Gupta
> Assignee: Harsh Vasava
> Priority: Critical
> Labels: security
>
> A *High-severity vulnerability (CVE-2026-56740)* has been identified in
> {{org.jline:jline-remote-telnet}} versions prior to 4.2.1. The vulnerable jar
> ({{{}jline-3.30.4.jar{}}} / {{{}jline-3.30.16{}}}) is shipped inside the
> Kafka release tarball under {{{}/opt/kafka/libs/{}}}, exposing all Docker
> images built from that tarball to the vulnerability.
> The fix upgrades {{org.jline}} to version *4.2.1* — the first release line in
> which {{jline-remote-telnet}} is patched — and replaces one deprecated API
> call that became a compile-time error under {{{}-Werror{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
