Hi James, The update to 1.11.1 was covered in KAFKA-20842 <https://issues.apache.org/jira/browse/KAFKA-20842>. The CVE fix will be included in the upcoming Kafka 4.4 release which is targeted for September according to the Release Plan <https://cwiki.apache.org/confluence/spaces/KAFKA/pages/429064575/Release+Plan+4.4.0>. There was also a backport to the 4.3 branch which means the CVE fix will be included in a subsequent release, but AFAIK there is no planned date yet for 4.3.2.
As a side-note I have noticed there is new security release for lz4, created KAFKA-20937 <https://issues.apache.org/jira/browse/KAFKA-20937> to track the update. Best regards, Gergely On Thu, 13 Aug 2026 at 05:59, JAMES JOSE <[email protected]> wrote: > Hi Team, > > As per the GitHub advisory for GHSA-xx22-p4ch-683r (CVE-2026-59949), > lz4-java versions up to and including 1.11.0 are affected, with the issue > fixed in version 1.11.1. GitHub Advisory – GHSA-xx22-p4ch-683r< > https://github.com/advisories/GHSA-xx22-p4ch-683r?utm_source=chatgpt.com> > > We understand that the latest Kafka version currently uses lz4-java-1.10.2. > > Could you please confirm whether this means Kafka is affected by > CVE-2026-59949 and whether Kafka needs to be updated to use lz4-java 1.11.1 > or later? > > If a Kafka update is required, could you also let us know whether there is > a planned Kafka release that will include the fixed version, and the > expected release date? > > Thanks, > James > >
