Skip to content

KAFKA-19951: Update lz4 dependency version for CVE-2025-12183 & CVE-2025-66566 #21035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mimaison merged 9 commits into from
Dec 9, 2025
+6 −4
Merged

KAFKA-19951: Update lz4 dependency version for CVE-2025-12183 & CVE-2025-66566 #21035

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
a219252
Update lz4 dependency version
erikanderson Dec 2, 2025
bb9f817
Updated license binary for lz4
Dec 2, 2025
51c520e
Update gav for lz4
erikanderson Dec 2, 2025
6b96154
Add ref to lz4 constants
erikanderson Dec 2, 2025
088e16c
Add comment to compression type ref for lz4
erikanderson Dec 3, 2025
21233d1
Merge branch 'trunk' into patch-1
chia7712 Dec 5, 2025
cd8be9e
use 1.10.0 instead
chia7712 Dec 5, 2025
949e90a
Update lz4-java for CVE-2025-66566
erikanderson Dec 5, 2025
1fd78dd
Update NOTICE-binary
mimaison Dec 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion LICENSE-binary
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ License Version 2.0:
- log4j-core-2.25.1
- log4j-slf4j-impl-2.25.1
- log4j-1.2-api-2.25.1
- lz4-java-1.8.0
- lz4-java-1.8.1
- maven-artifact-3.9.6
- metrics-core-2.2.0
- opentelemetry-proto-1.3.2-alpha
Expand Down
6 changes: 4 additions & 2 deletions gradle/dependencies.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,9 @@ versions += [
kafka_41: "4.1.1",
log4j2: "2.25.1",
// When updating lz4 make sure the compression levels in org.apache.kafka.common.record.CompressionType are still valid
lz4: "1.8.0",
// https://github.com/apache/kafka/blob/trunk/clients/src/main/java/org/apache/kafka/common/record/CompressionType.java#L73-L74
// https://github.com/yawkat/lz4-java/blob/main/src/java/net/jpountz/lz4/LZ4Constants.java#L23-L24
lz4: "1.8.1",
Copy link
Member

@mimaison mimaison Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we directly bump to 1.10.0?

Copy link
Member

@chia7712 chia7712 Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done (cd8be9e)

mavenArtifact: "3.9.6",
metrics: "2.2.0",
mockito: "5.20.0",
Expand Down Expand Up @@ -211,7 +213,7 @@ libs += [
log4j1Bridge2Api: "org.apache.logging.log4j:log4j-1.2-api:$versions.log4j2",
log4j2Api: "org.apache.logging.log4j:log4j-api:$versions.log4j2",
log4j2Core: "org.apache.logging.log4j:log4j-core:$versions.log4j2",
lz4: "org.lz4:lz4-java:$versions.lz4",
lz4: "at.yawk.lz4:lz4-java:$versions.lz4",
metrics: "com.yammer.metrics:metrics-core:$versions.metrics",
mockitoCore: "org.mockito:mockito-core:$versions.mockito",
mockitoJunitJupiter: "org.mockito:mockito-junit-jupiter:$versions.mockito",
Expand Down