KAFKA-19951: Update lz4 dependency version for CVE-2025-12183 & CVE-2025-66566 by erikanderson · Pull Request #21035 · apache/kafka

erikanderson · 2025-12-02T00:55:30Z

Updated lz4 dependency version from 1.8.0 to 1.10.1

CVE-2025-12183

https://nvd.nist.gov/vuln/detail/CVE-2025-12183

CVE-2025-66566

https://nvd.nist.gov/vuln/detail/CVE-2025-66566

Releases

https://github.com/yawkat/lz4-java/releases/tag/v1.8.1
https://github.com/yawkat/lz4-java/releases/tag/v1.10.0
https://github.com/yawkat/lz4-java/releases/tag/v1.10.1

Reviewers: Gaurav Narula gaurav_narula2@apple.com, Lan Ding
isDing_L@163.com, Chia-Ping Tsai chia7712@gmail.com, Mickael Maison
mimaison@apache.org, PoAn Yang payang@apache.org

Updated lz4 dependency version from 1.8.0 to 1.8.1. For https://nvd.nist.gov/vuln/detail/CVE-2025-12183

DL1231 · 2025-12-02T02:33:27Z

Thanks for the patch. Could you also update LICENSE-binary and ensure the compression levels in org.apache.kafka.common.record.CompressionType are still valid?

erikanderson · 2025-12-02T16:10:40Z

@DL1231 thank you, updated license binary, do you know how org.apache.kafka.common.record.CompressionType has been confirmed in the past?

mimaison · 2025-12-02T16:59:31Z

I linked the PR to KAFKA-19951.

Regarding the compression level, it's explained in CompressionType: https://github.com/apache/kafka/blob/trunk/clients/src/main/java/org/apache/kafka/common/record/CompressionType.java#L73-L74

mimaison · 2025-12-02T17:00:46Z

Also there's still a build issue:

Could not determine the dependencies of task ':clients:shadowJar'.
> Could not resolve all dependencies for configuration ':clients:runtimeClasspath'.
   > Could not resolve org.lz4:lz4-java:1.8.1.
     Required by:
         project ':clients'
      > Module 'org.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by ['at.yawk.lz4:lz4-java:1.8.1' (runtimeElements)]
   > Could not resolve at.yawk.lz4:lz4-java:1.8.1.
     Required by:
         project ':clients' > org.lz4:lz4-java:1.8.1
      > Module 'at.yawk.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by ['org.lz4:lz4-java:1.8.1' (runtime)]

erikanderson · 2025-12-02T17:05:49Z

Also there's still a build issue:

Could not determine the dependencies of task ':clients:shadowJar'.
> Could not resolve all dependencies for configuration ':clients:runtimeClasspath'.
   > Could not resolve org.lz4:lz4-java:1.8.1.
     Required by:
         project ':clients'
      > Module 'org.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by ['at.yawk.lz4:lz4-java:1.8.1' (runtimeElements)]
   > Could not resolve at.yawk.lz4:lz4-java:1.8.1.
     Required by:
         project ':clients' > org.lz4:lz4-java:1.8.1
      > Module 'at.yawk.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by ['org.lz4:lz4-java:1.8.1' (runtime)]

It looks like there was a recent change to discontinue https://github.com/lz4/lz4-java, in favor of community fork https://github.com/yawkat/lz4-java . I'll try updating to new GAV

yawkat · 2025-12-02T20:08:18Z

Maintainer here. Interesting, did you see that error when depending on org.lz4:lz4-java:1.8.1 directly, without any reference to at.yawk.lz4? Maybe there's something wrong with the gradle capability metadata

erikanderson · 2025-12-02T20:10:47Z

https://github.com/apache/kafka/blob/trunk/clients/src/main/java/org/apache/kafka/common/record/CompressionType.java#L73-L74

Looks like max compression level is unchanged at 16+1 https://github.com/yawkat/lz4-java/blob/d9488323123899f90041187c20801deabcae1bef/src/java/net/jpountz/lz4/LZ4Constants.java#L24

erikanderson · 2025-12-02T20:20:20Z

Maintainer here. Interesting, did you see that error when depending on org.lz4:lz4-java:1.8.1 directly, without any reference to at.yawk.lz4? Maybe there's something wrong with the gradle capability metadata

Yeah, had to switch to your gav for it to work (I'm just a random person not affil with apache): 51c520e

gradle/dependencies.gradle

mjschwaiger · 2025-12-03T10:11:46Z

'org.lz4:lz4-java:1.8.1

Simple example demonstrating the issue mentioned by @mimaison:

plugins {
    id 'java'
}

repositories {
    mavenCentral()
}

dependencies {
    // (1) only -> success
    // (2) only -> error, but: capability conflict not expected
    // (3) only -> success
    // (1) + (2) -> error (expected?)
    // (1) + (3) -> error (capability conflict as expected)
    // (2) + (3) -> error (capability conflict as expected)

    // implementation 'org.lz4:lz4-java:1.8.0' // (1)
    implementation 'org.lz4:lz4-java:1.8.1' // (2)
    // implementation 'at.yawk.lz4:lz4-java:1.8.1' // (3)
}

If only org.lz4:lz4-java:1.8.1 (2) is used, this unexpected build error will occur:

Could not determine the dependencies of task ':testlz4:compileJava'.
> Could not resolve all dependencies for configuration ':testlz4:compileClasspath'.
   > Could not resolve org.lz4:lz4-java:1.8.1.
     Required by:
         project :testlz4
      > Module 'org.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by [at.yawk.lz4:lz4-java:1.8.1(apiElements)]
   > Could not resolve at.yawk.lz4:lz4-java:1.8.1.
     Required by:
         project :testlz4 > org.lz4:lz4-java:1.8.1
      > Module 'at.yawk.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by [org.lz4:lz4-java:1.8.1(compile)]

There might be an issue with the capability configuration together with the relocation settings, which could be the reason for the problem.

yawkat · 2025-12-03T10:19:32Z

@mjschwaiger I made a test case here: https://github.com/yawkat/test-case-gradle-rename-capability

I think it's a gradle bug, I've asked on the gradle community slack about it.

chia7712

LGTM

chia7712 · 2025-12-04T05:55:10Z

@mimaison do you have time to take a look at this?

ccudennec-otto · 2025-12-04T07:17:37Z

BTW: If the Java project is discontinued, I think it would be a good idea to get rid of the library. Not sure where I could raise this question as an issue.

chia7712 · 2025-12-04T07:31:52Z

Not sure where I could raise this question as an issue.

I recommend KAFKA-17301 for raising this issue 😄

mimaison · 2025-12-04T09:05:45Z

gradle/dependencies.gradle

-  lz4: "1.8.0",
+  // https://github.com/apache/kafka/blob/trunk/clients/src/main/java/org/apache/kafka/common/record/CompressionType.java#L73-L74
+  // https://github.com/yawkat/lz4-java/blob/main/src/java/net/jpountz/lz4/LZ4Constants.java#L23-L24
+  lz4: "1.8.1",


Should we directly bump to 1.10.0?

done (cd8be9e)

mimaison · 2025-12-09T16:13:11Z

I approved your account request and assigned KAFKA-19951 to you. Thanks!

ox-sag · 2025-12-09T18:50:44Z

when the release version will be released ?

chia7712 · 2025-12-10T01:59:38Z

when the release version will be released ?

3.9.2 (Nov 2025)
4.2.0 (January 2026)

I guess 3.9.2 release will be delayed :)

…025-66566 (apache#21035) Updated lz4 dependency version from 1.8.0 to 1.10.1 ## CVE-2025-12183 https://nvd.nist.gov/vuln/detail/CVE-2025-12183 ## CVE-2025-66566 https://nvd.nist.gov/vuln/detail/CVE-2025-66566 ## Releases https://github.com/yawkat/lz4-java/releases/tag/v1.8.1 https://github.com/yawkat/lz4-java/releases/tag/v1.10.0 https://github.com/yawkat/lz4-java/releases/tag/v1.10.1 Reviewers: Gaurav Narula <gaurav_narula2@apple.com>, Lan Ding <isDing_L@163.com>, Chia-Ping Tsai <chia7712@gmail.com>, Mickael Maison <mimaison@apache.org>, PoAn Yang <payang@apache.org> --------- Co-authored-by: Erik Anderson <erik@Eriks-MacBook-Air-M2.local> Co-authored-by: Chia-Ping Tsai <chia7712@gmail.com> Co-authored-by: Mickael Maison <mickael.maison@gmail.com>

skaluva · 2025-12-23T14:22:14Z

'org.lz4:lz4-java:1.8.1

Simple example demonstrating the issue mentioned by @mimaison:

plugins {
    id 'java'
}

repositories {
    mavenCentral()
}

dependencies {
    // (1) only -> success
    // (2) only -> error, but: capability conflict not expected
    // (3) only -> success
    // (1) + (2) -> error (expected?)
    // (1) + (3) -> error (capability conflict as expected)
    // (2) + (3) -> error (capability conflict as expected)

    // implementation 'org.lz4:lz4-java:1.8.0' // (1)
    implementation 'org.lz4:lz4-java:1.8.1' // (2)
    // implementation 'at.yawk.lz4:lz4-java:1.8.1' // (3)
}

If only org.lz4:lz4-java:1.8.1 (2) is used, this unexpected build error will occur:

Could not determine the dependencies of task ':testlz4:compileJava'.
> Could not resolve all dependencies for configuration ':testlz4:compileClasspath'.
   > Could not resolve org.lz4:lz4-java:1.8.1.
     Required by:
         project :testlz4
      > Module 'org.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by [at.yawk.lz4:lz4-java:1.8.1(apiElements)]
   > Could not resolve at.yawk.lz4:lz4-java:1.8.1.
     Required by:
         project :testlz4 > org.lz4:lz4-java:1.8.1
      > Module 'at.yawk.lz4:lz4-java' has been rejected:
           Cannot select module with conflict on capability 'org.lz4:lz4-java:1.8.1' also provided by [org.lz4:lz4-java:1.8.1(compile)]

There might be an issue with the capability configuration together with the relocation settings, which could be the reason for the problem.

I'm exactly facing this, struggling to switch this dependency with the new group. But with the gradle capability feature, it works when i define like this:

dependencies {
    implementation ("org.apache.kafka:kafka-clients:3.9.1"){
        exclude group: "org.lz4", module:"lz4-java"
    }
    implementation "at.yawk.lz4:lz4-java:1.10.1" //group changed in newer versions
}
    
configurations.configureEach {
    resolutionStrategy {
        // 1. Resolve capability conflict (CRITICAL)
        capabilitiesResolution.withCapability("org.lz4:lz4-java") {
            select("at.yawk.lz4:lz4-java:1.10.1")
            because("CVE-2025-12183, CVE-2025-66566 – groupId migrated")
        }
    }
}

But in my case the problem is, all my consumers of my internal framework (which uses above kafka-clients) are forced to define above logic to make it work, which i didnt like. Hope in newer versions of kafka-clients, they update their dependency graph with new group.

marcelstoer · 2025-12-23T14:30:23Z

Hope in newer versions of kafka-clients, they update their dependency graph with new group.

They already did: #21035 <-- this PR

skaluva · 2025-12-23T14:31:57Z

Hope in newer versions of kafka-clients, they update their dependency graph with new group.

They already did: #21035

Oh yeah.. missed reading entire thread.. but looks like 3.9.2 is not yet released :)

chia7712 · 2025-12-23T14:40:58Z

but looks like 3.9.2 is not yet released :)

It's currently in the oven! Stay tuned 😄

omarmahamid · 2026-01-07T09:08:24Z

@chia7712

Let’s just hope it’s baking nicely and not getting a little too crispy 😄

radarsh · 2026-01-14T11:35:20Z

Sorry to be pushy, but when can we expect a new version of 3.9.x with this fix? People in my organisation are panicking as this vulnerability has a high score.

chia7712 · 2026-01-14T11:46:38Z

Sorry to be pushy, but when can we expect a new version of 3.9.x with this fix? People in my organisation are panicking as this vulnerability has a high score.

Definitely. We understand the urgency. We are currently preparing the 3.9.2 RC0, and I will share the release discussion link here as soon as it is ready

FrankYang0529 · 2026-01-14T15:55:06Z

Currently, most of 3.9.2-rc0 artifacts are ready. I'm waiting for apache/kafka-native:3.9.2-rc0 image (https://github.com/apache/kafka/actions/runs/20998197324). I will start the vote thread after it's ready. Thanks.

FrankYang0529 · 2026-01-15T03:48:03Z

3.9.2-rc0 vote thread: https://lists.apache.org/thread/t83xx0f4bfo160zhnnh885qh27o494dh

skaluva · 2026-01-19T13:28:30Z

I still dont see 3.9.2 artifacts in maven central repo.. any idea when those will be available for public use..
(sorry for asking this, im not aware on how to use above vote thread mentioned)

FrankYang0529 · 2026-01-19T13:51:25Z

@skaluva Based on release document, the rc version is not pushed to maven central repo.

https://maven.apache.org/guides/development/guide-testing-releases.html
https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=34840886#ReleaseProcess-Afterthevotepasses

radarsh · 2026-01-22T14:01:56Z

21st January has passed. The RC has only received one +1 vote. Now what happens? Do we wait indefinitely until the required number of votes are cast or is there a time limit after which release will be cut anyway?

chia7712 · 2026-01-22T14:14:44Z

21st January has passed. The RC has only received one +1 vote. Now what happens? Do we wait indefinitely until the required number of votes are cast or is there a time limit after which release will be cut anyway?

Good point. We have been jugging between two releases lately, which is why the 3.9.2 RC is moving a bit slower. We are on it and will case the necessary votes once the validation is complete.

skaluva · 2026-01-30T09:18:05Z

Any update on this please? all our repositories mend scans are failing due to this and our infosec team is behind us.. :(

chia7712 · 2026-01-31T03:59:14Z

Any update on this please? all our repositories mend scans are failing due to this and our infosec team is behind us.. :(

Totally understand the pressure from your infosec team. The fix is nearly ready - we are waiting on the very last vote for approval. It should be moving forward very shortly

omarmahamid · 2026-01-31T09:15:12Z

chia7712 · 2026-01-31T13:23:36Z

BTW, it would be super helpful if you guys could join the release vote thread and help verify the RC. Even if your "+1" is non-binding, sharing your test results gives the maintainers the final confidence needed to close the vote

For instance, @jiafu1115 has already helped verify the 3.9.2-RC in their environment, ensuring it does not burn out the server. If you have time, please jump in and help us cross the finish line

vote thread: https://lists.apache.org/thread/t83xx0f4bfo160zhnnh885qh27o494dh

tobbin2 · 2026-02-03T13:45:54Z

When can we expect the release date of 3.9.2, how long does it usually take for the last legendary voter?

yeikel · 2026-02-03T16:17:14Z

When can we expect the release date of 3.9.2,

You should consider following the email list for updates

how long does it usually take for the last legendary voter?

This legendary voter could be you. For example, download the RC, test it and share feedback. It is a community effort 🚀

radarsh · 2026-02-04T09:38:05Z

I think we had the legendary vote yesterday. I'm assuming now it's just pending release formalities?

chia7712 · 2026-02-04T14:30:49Z

Yes, we have the legendary voter. At the same time, we’re investigating a patch regarding a CVE. Hopefully, this will not lead to another RC

#21395

yeikel · 2026-02-04T14:37:16Z

Yes, we have the legendary voter. At the same time, we’re investigating a patch regarding a CVE. Hopefully, this will not lead to another RC

#21395

That's a pretty high severity CVE, thanks for the great work. We'll need to wait or the sec teams will still chase us anyways 😃

skaluva · 2026-02-05T08:35:35Z

when do i see it here?

Entire kafka industry plagued with this CVE.. :D

chia7712 · 2026-02-05T09:15:52Z

Entire kafka industry plagued with this CVE..

Not just Kafka. We're all in this burning building together. 🔥

yawkat · 2026-02-05T10:13:37Z

You're welcome 🤗

Update lz4 dependency version

a219252

Updated lz4 dependency version from 1.8.0 to 1.8.1. For https://nvd.nist.gov/vuln/detail/CVE-2025-12183

github-actions bot added triage PRs from the community build Gradle build or GitHub Actions small Small PRs labels Dec 2, 2025

DL1231 added the ci-approved label Dec 2, 2025

chia7712 changed the title ~~Update lz4 dependency version for CVE-2025-12183~~ MINOR: Update lz4 dependency version for CVE-2025-12183 Dec 2, 2025

Updated license binary for lz4

bb9f817

github-actions bot added the dependencies Pull requests that update a dependency file label Dec 2, 2025

mimaison changed the title ~~MINOR: Update lz4 dependency version for CVE-2025-12183~~ KAFKA-19951: Update lz4 dependency version for CVE-2025-12183 Dec 2, 2025

Update gav for lz4

51c520e

Add ref to lz4 constants

6b96154

chia7712 reviewed Dec 2, 2025

View reviewed changes

gradle/dependencies.gradle Show resolved Hide resolved

github-actions bot removed the triage PRs from the community label Dec 3, 2025

Add comment to compression type ref for lz4

088e16c

gaurav-narula approved these changes Dec 3, 2025

View reviewed changes

chia7712 approved these changes Dec 4, 2025

View reviewed changes

mimaison reviewed Dec 4, 2025

View reviewed changes

appsec-tpc mentioned this pull request Jan 20, 2026

Update lz4-java dependency to fix CVE-2025-12183 FusionAuth/fusionauth-issues#3305

Open

Conversation

erikanderson commented Dec 2, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CVE-2025-12183

CVE-2025-66566

Releases

Uh oh!

DL1231 commented Dec 2, 2025

Uh oh!

erikanderson commented Dec 2, 2025

Uh oh!

mimaison commented Dec 2, 2025

Uh oh!

mimaison commented Dec 2, 2025

Uh oh!

erikanderson commented Dec 2, 2025

Uh oh!

yawkat commented Dec 2, 2025

Uh oh!

erikanderson commented Dec 2, 2025

Uh oh!

erikanderson commented Dec 2, 2025

Uh oh!

Uh oh!

mjschwaiger commented Dec 3, 2025

Uh oh!

yawkat commented Dec 3, 2025

Uh oh!

chia7712 left a comment

Choose a reason for hiding this comment

Uh oh!

chia7712 commented Dec 4, 2025

Uh oh!

ccudennec-otto commented Dec 4, 2025

Uh oh!

chia7712 commented Dec 4, 2025

Uh oh!

mimaison Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

chia7712 Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

mimaison commented Dec 9, 2025

Uh oh!

ox-sag commented Dec 9, 2025

Uh oh!

chia7712 commented Dec 10, 2025

Uh oh!

skaluva commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marcelstoer commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skaluva commented Dec 23, 2025

Uh oh!

chia7712 commented Dec 23, 2025

Uh oh!

omarmahamid commented Jan 7, 2026

Uh oh!

radarsh commented Jan 14, 2026

Uh oh!

chia7712 commented Jan 14, 2026

Uh oh!

FrankYang0529 commented Jan 14, 2026

Uh oh!

FrankYang0529 commented Jan 15, 2026

Uh oh!

skaluva commented Jan 19, 2026

Uh oh!

FrankYang0529 commented Jan 19, 2026

Uh oh!

radarsh commented Jan 22, 2026

Uh oh!

chia7712 commented Jan 22, 2026

Uh oh!

skaluva commented Jan 30, 2026

Uh oh!

chia7712 commented Jan 31, 2026

erikanderson commented Dec 2, 2025 •

edited by github-actions bot

Loading

skaluva commented Dec 23, 2025 •

edited

Loading

marcelstoer commented Dec 23, 2025 •

edited

Loading

tobbin2 commented Feb 3, 2026 •

edited

Loading

yeikel commented Feb 3, 2026 •

edited

Loading

skaluva commented Feb 5, 2026 •

edited

Loading