Kafka jetty vulnerabilities fixes

[Vivek Agarwal B via users]

Hello Kafka Team,

Below are the vulnerabilities which are identified in Jetty v12.0.37. They are 
fixed in jetty version 12.0.38.
Kafka 4.4.0 rc still uses Jetty 12.0.37, could you please confirm if the formal 
kafka 4.4.0 release will upgrade the jetty version to 12.0.38?


  *   CVE-2026-12611 (HTTP/2 thread exhaustion DoS)
  *   CVE-2026-19203 (HTTP Request Smuggling)
  *   CVE-2026-19204 (WebSocket memory exhaustion DoS)

Regards
Vivek