Hello Flink Community,
I am currently running Apache Flink flink-2.2.1-bin-scala_2.12 in production
and have identified two CVEs that appear in Flink's dependency vulnerability
list. I would like to consult the community on two questions:
1. Do these CVEs have any impact on a running flink-2.2.1-bin-scala_2.12
deployment?
2. Is there a plan to address these vulnerabilities in the next Flink release,
and if so, when is the next release expected?
Below is the list of CVEs I have identified:
┌──────────────────────┬───────────────────────────────────────┬──────────────────────────────────────────────────┐
│ CVE ID │ Affected Component │ Description
│
├──────────────────────┼───────────────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-34481 │ Apache Log4j JSON Template Layout │ CVSS 4.0: 6.3
MEDIUM ― JsonTemplateLayout │
│ │ (log4j-core) │ outputs
non-RFC-8259-compliant JSON when log │
│ │ │ events contain
non-finite floating-point values │
│ │ │ (NaN,
Infinity); fixed in Log4j 2.25.4 │
├──────────────────────┼───────────────────────────────────────┼──────────────────────────────────────────────────┤
│ CVE-2026-34479 │ Apache Log4j 1-to-Log4j 2 Bridge │ CVSS 3.1: 7.5
HIGH ― Log4j1XmlLayout does not │
│ │ (log4j-1.2-api) │ escape XML 1.0
forbidden characters, causing │
│ │ │ downstream
parsers to fail; fixed in │
│ │ │ Log4j 2.25.4
│
└──────────────────────┴───────────────────────────────────────┴──────────────────────────────────────────────────┘
My questions:
1. Impact assessment: Do these CVEs affect a running
flink-2.2.1-bin-scala_2.12 deployment? For example:
- Which Log4j version does flink-2.2.1-bin-scala_2.12 depend on?
- Is the Log4j version bundled in Flink 2.2.1 within the affected range
(2.14.0 <= version < 2.25.4 for CVE-2026-34481;
2.7 <= version < 2.25.4 for CVE-2026-34479)?
- Does Flink use JsonTemplateLayout or Log4j1XmlLayout in its default
logging configuration? If not, is the vulnerability still reachable?
- Are there any specific Flink features or components that expose these
Log4j layouts in a way that could be exploited?
2. Upgrade roadmap: Is there a plan to update the Log4j dependency to
2.25.4 or later in the next Flink release? If so:
- Which release will include the fix?
- What is the estimated release timeframe?
Any guidance or pointers to relevant JIRA issues would be greatly
appreciated.
Thank you for your time and the great work on Flink.
Best regards,
Dking
[email protected]
