Hi Ken Since you asked for suggestions about the CVE: I'd suggest rolling the next RC to include those fixes.
I understand it is boring to roll the rock over and over, but there are no votes yet, so it is not too late. WDYT? Best, Chia-Ping On 2026-10-08 11:46 UTC 黃竣陽 wrote: > Hello Kafka users, developers and client-developers, > > This is the second candidate for release of Apache Kafka 4.3.2. > > This is a bugfix release in 4.3 line. > > Release notes for the 4.3.2 release: > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc1/RELEASE_NOTES.html > <https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc/RELEASE_NOTES.html> > > Please download, test and vote by Tuesday, October 13th, 9am PT > > Kafka's KEYS file containing PGP keys we use to sign the release: > https://downloads.apache.org/kafka/KEYS > > * Release artifacts to be voted upon (source and binary): > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc1/ > <https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc/> > > * Docker release artifacts to be voted upon: > apache/kafka:4.3.2-rc1 > apache/kafka-native:4.3.2-rc1 > > * Maven artifacts to be voted upon: > https://repository.apache.org/content/groups/staging/org/apache/kafka/ > > * Javadoc: > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc1/javadoc/index.html > > * Tag to be voted upon (off 4.3 branch) is the 4.3.2 tag: > https://github.com/apache/kafka/releases/tag/4.3.2-rc1 > > * Documentation: > https://kafka.apache.org/43/documentation.html > > * Protocol: > https://kafka.apache.org/43/design/protocol > > * Successful CI builds for the 4.3 branch: > Unit/integration tests: > https://github.com/apache/kafka/actions/runs/37632175708 > System tests: https://jenkins.opensource4you.tw/job/kafka-e2e/967/ > > * Docker Image Github Actions Pipeline for 4.3 branch: > Docker Build Test Pipeline (JVM): > https://github.com/apache/kafka/actions/runs/37769307897 > Docker Build Test Pipeline (Native): > https://github.com/apache/kafka/actions/runs/37769370154 > > The native pipeline is green. The JVM pipeline reports four HIGH findings, > all denial-of-service issues in Jackson 2.21.6 and all fixed in 2.21.7: > CVE-2026-89407, CVE-2026-89425 (jackson-core) CVE-2026-91776, CVE-2026-91777 > (jackson-databind) > I have not picked up the Jackson bump for this bugfix release, but am happy > to roll another > RC if the community prefers to include it. > > Thanks, > Jiunn-Yang Huang
