USM Agent 1.2.1 did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.8 | \ngoogle.golang.org/grpc < 1.82.1 | \ngoogle.golang.org/grpc = 1.82.1 | \n
| \n | 8.2 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.56.0 | \n
| \n | 8.2 | \nstdlib < 1.25.13 | \nstdlib = 1.25.13 | \n
| \n | 8.1 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.56.0 | \n
| \n | 8.1 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.56.0 | \n
| \n | 7.8 | \nstdlib < 1.25.12 | \nstdlib = 1.25.13 | \n
| \n | 7.5 | \nstdlib < 1.25.11 | \nstdlib = 1.25.13 | \n
| \n | 7.5 | \nstdlib < 1.25.13 | \nstdlib = 1.25.13 | \n
| \n | 7.5 | \nstdlib < 1.25.11 | \nstdlib = 1.25.13 | \n
| \n | 7.5 | \ngolang.org/x/net < 0.56.0 | \ngolang.org/x/net = 0.56.0 | \n
| \n | 7.5 | \ngolang.org/x/text < 0.39.0 | \ngolang.org/x/text = 0.39.0 | \n
| \n | 7.5 | \nstdlib < 1.25.13 | \nstdlib = 1.25.13 | \n
| \n | 7.5 | \nstdlib < 1.25.13 | \nstdlib = 1.25.13 | \n
| \n | 7.5 | \nstdlib < 1.25.13 | \nstdlib = 1.25.13 | \n
| \n | 6.5 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.56.0 | \n
| \n | 6.1 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.56.0 | \n
| \n | 6.1 | \nstdlib < 1.25.13 | \nstdlib = 1.25.13 | \n
| \n | 5.9 | \nstdlib < 1.25.13 | \nstdlib = 1.25.13 | \n
| \n | 5.4 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.56.0 | \n
| \n | 5.3 | \nstdlib < 1.25.12 | \nstdlib = 1.25.13 | \n
| \n | 5.3 | \nstdlib < 1.25.11 | \nstdlib = 1.25.13 | \n
This patch release uses Red Hat Universal Base Image 9 Micro version 9.8-1786321990.
","user_segment_ids":[]},{"id":52431663213716,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52431663213716.json","html_url":"https://support.confluent.io/hc/en-us/articles/52431663213716-CONFSA-2026-15-Confluent-Cloud-and-Confluent-Platform-Vulnerability-Denial-of-Service-in-Schema-Registry-via-external-schema-references","author_id":5842944700052,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-12T20:27:37Z","updated_at":"2026-08-12T20:27:44Z","name":"CONFSA-2026-15: Confluent Cloud and Confluent Platform Vulnerability: Denial of Service in Schema Registry via external schema references","title":"CONFSA-2026-15: Confluent Cloud and Confluent Platform Vulnerability: Denial of Service in Schema Registry via external schema references","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T20:27:44Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Impacted versions:
Recommended action:
Issue:
Schema Registry supports remotely hosted schema references through fields such as $ref and $dynamicRef in JSON schemas. Although those external sub-schemas are not incorporated into the final constructed schema, the service still fetches them over the network and processes the response in memory. An authenticated attacker can exploit this behavior by registering a schema that references a very large remotely hosted schema, which can trigger a denial-of-service condition. and impact other tenants sharing the same physical Schema Registry cluster in Confluent Cloud. An attacker can also force server-side requests to arbitrary endpoints using references but we did not find any impact due to this vector in Confluent Cloud.
Remediation:
CVSS Scores:
A cluster link authenticating to a metadata server through a token login callback handler takes its target from metadataServerUrls in the handler's SASL JAAS configuration. That user-submitted URL was not validated, so a principal holding the cluster-administrator rights can create a source-initiated cluster link that could direct the broker to an arbitrary endpoint, and the broker would issue authenticated requests to it during link initialization.
This crosses a trust boundary in deployments where cluster administration is tenant-scoped while the broker itself runs in an operator-controlled network: the link creator gains server-side request forgery against internal services they cannot otherwise reach.
CVSS Scores:
The version of Netty bundled with Confluent Platform is affected by several vulnerabilities. Each relevant CVE is documented below, along with its impact on Confluent Platform, the preconditions required for exploitation, and its associated CVSS score.
CVE-2026-50020
Impacted Component: KsqlDB
Before parsing the first request-line, Netty's HttpObjectDecoder silently skips every byte for which Character.isISOControl(b) is true (0x00–0x1F and 0x7F), along with whitespace. RFC 9112 permits ignoring only empty CRLF lines, so this over-permissive parsing can desynchronize request boundaries between Netty and an upstream component.
Exploitation requires Netty to sit behind a front-end proxy that forwards such prepended bytes rather than stripping or rejecting them. On pipelined or multiplexed connections, an attacker can use the resulting boundary mismatch to smuggle an additional request past the front end, potentially bypassing access controls enforced there. The impact is to integrity only, no information disclosure is attributed to this issue.
CVSS: 5.3 (CVSS v3.1 Calculator)
CVE-2026-50560
Impacted Component: KsqlDB
An HTTP/2 client can send a SETTINGS frame advertising an abnormally small SETTINGS_MAX_HEADER_LIST_SIZE. When the Netty server subsequently attempts to send response headers that exceed this limit, header encoding fails, an exception is thrown, and the stream is reset. As with an HTTP/2 Rapid Reset attack, a client can issue requests in a loop to force continuous server-side exception handling, consuming CPU and memory and degrading availability. Exploitation requires the ability to establish an HTTP/2 connection to an affected endpoint.
CVSS: 5.3 (CVSS v3.1 Calculator)
CVE-2026-45416
Impacted Component: KsqlDB
SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello spans multiple records, immediately allocates a buffer of the declared size — up to 16 MiB — from just nine attacker-controlled bytes. The commonly-used SniHandler constructors disable the length guard (maxClientHelloLength=0) and schedule no handshake timeout, so each connection pins a large unpooled buffer until the channel closes. An attacker can exhaust memory with minimal bandwidth, before the TLS handshake completes and without authentication.
Exploitation requires Netty to be configured for SNI-based routing (SniHandler), which is not enabled by default in Confluent Platform. Where it is in use, constructing the handler with a non-zero maxClientHelloLength restores the guard.
CVSS: 7.5 (CVSS v3.1 Calculator)
CVE-2026-44893
Impacted Component: KsqlDB
While decoding a PROXY protocol v2 header, HAProxyMessage.readNextTLV() retains a slice of the pooled cumulation buffer before reading the SSL TLV's 1-byte client field and 4-byte verify field. If an attacker declares a TLV length below 5, those reads exceed the available bytes and an IndexOutOfBoundsException is thrown. HAProxyMessageDecoder catches only HAProxyProtocolException, so the exception propagates and the retained slice is never released. An attacker can repeat this on new connections to accumulate leaked buffers until memory is exhausted, degrading or halting service availability.
Exploitation requires Netty to be configured to accept PROXY protocol headers, which is not enabled by default in Confluent Platform.
CVSS: 7.5 (CVSS v3.1 Calculator)
CVE-2026-48059
Impacted Component: KsqlDB
Netty's PROXY protocol v2 codec leaks native or heap memory on every connection that carries a syntactically valid header containing nested PP2_TYPE_SSL TLVs at depth two or greater. The leak occurs on the successful parse path: no exception is thrown, the message is passed downstream, the decoder removes itself, and the application releases the HAProxyMessage normally — yet the release routine does not recurse into nested TLVs, so the reference count on the underlying pooled cumulation buffer never reaches zero and the buffer remains permanently pinned. An attacker can open connections repeatedly to accumulate pinned buffers until memory is exhausted, degrading or halting service availability.
The affected code path requires Netty to be configured to accept PROXY protocol headers, which is not enabled by default in Confluent Platform.
CVSS: 7.5 (CVSS v3.1 Calculator)
Confluent Platform patch release version 8.3.1 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 8.3.1 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 8.3.1. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 8.3.1. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/8.3/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 8.3.1. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/current/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 8.3.1.
Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.1 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http < 4.1.135.Final \nio.netty:netty-codec-http < 4.2.15.Final \n | \n\n io.netty:netty-codec-http = 4.1.135.Final \nio.netty:netty-codec-http = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-epoll < 4.1.135.Final \nio.netty:netty-transport-native-epoll < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-kqueue < 4.1.135.Final \nio.netty:netty-transport-native-kqueue < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-kqueue = 4.1.135.Final \nio.netty:netty-transport-native-kqueue = 4.2.15.Final \n | \n
This patch release uses Red Hat Universal Base Image 9 Micro version 9.8-1784702951.
","user_segment_ids":[]},{"id":52069564197268,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52069564197268.json","html_url":"https://support.confluent.io/hc/en-us/articles/52069564197268-Security-Release-Notes-for-CP-8-2-3-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T06:36:02Z","updated_at":"2026-08-12T21:07:13Z","name":"Security Release Notes for CP 8.2.3 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 8.2.3 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:13Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 8.2.3 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 8.2.3 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 8.2.3. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 8.2.3. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/8.2/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 8.2.3. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/8.2/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 8.2.3. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.1 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http < 4.1.135.Final \nio.netty:netty-codec-http < 4.2.15.Final \n | \n\n io.netty:netty-codec-http = 4.1.135.Final \nio.netty:netty-codec-http = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-epoll < 4.1.135.Final \nio.netty:netty-transport-native-epoll < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-kqueue < 4.1.135.Final \nio.netty:netty-transport-native-kqueue < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-kqueue = 4.1.135.Final \nio.netty:netty-transport-native-kqueue = 4.2.15.Final \n | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1784705586.
","user_segment_ids":[]},{"id":52069492598420,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52069492598420.json","html_url":"https://support.confluent.io/hc/en-us/articles/52069492598420-Security-Release-Notes-for-CP-8-1-5-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T06:33:35Z","updated_at":"2026-08-12T21:07:15Z","name":"Security Release Notes for CP 8.1.5 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 8.1.5 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:15Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 8.1.5 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 8.1.5 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 8.1.5. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 8.1.5. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/8.1/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 8.1.5. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/8.1/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 8.1.5. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.1 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http < 4.1.135.Final \nio.netty:netty-codec-http < 4.2.15.Final \n | \n\n io.netty:netty-codec-http = 4.1.135.Final \nio.netty:netty-codec-http = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-epoll < 4.1.135.Final \nio.netty:netty-transport-native-epoll < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-kqueue < 4.1.135.Final \nio.netty:netty-transport-native-kqueue < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-kqueue = 4.1.135.Final \nio.netty:netty-transport-native-kqueue = 4.2.15.Final \n | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1785214301.
","user_segment_ids":[]},{"id":52069515927956,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52069515927956.json","html_url":"https://support.confluent.io/hc/en-us/articles/52069515927956-Security-Release-Notes-for-CP-8-0-7-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T06:32:08Z","updated_at":"2026-08-12T21:07:16Z","name":"Security Release Notes for CP 8.0.7 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 8.0.7 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:16Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 8.0.7 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 8.0.7 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 8.0.7. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 8.0.7. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/8.0/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 8.0.7. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/8.0/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 8.0.7. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.7 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 8.1 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \n\n io.netty:netty-handler < 4.1.135.Final \nio.netty:netty-handler < 4.2.15.Final \n | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.2.15.Final \n | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \n\n io.netty:netty-resolver-dns < 4.1.135.Final \nio.netty:netty-resolver-dns < 4.2.15.Final \n | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.2.15.Final \n | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http < 4.1.135.Final \nio.netty:netty-codec-http < 4.2.15.Final \n | \n\n io.netty:netty-codec-http = 4.1.135.Final \nio.netty:netty-codec-http = 4.2.15.Final \n | \n
| \n | 5.3 | \n\n io.netty:netty-codec-http2 < 4.1.135.Final \nio.netty:netty-codec-http2 < 4.2.15.Final \n | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-kqueue < 4.1.135.Final \nio.netty:netty-transport-native-kqueue < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-kqueue = 4.1.135.Final \nio.netty:netty-transport-native-kqueue = 4.2.15.Final \n | \n
| \n | 4.0 | \n\n io.netty:netty-transport-native-epoll < 4.1.135.Final \nio.netty:netty-transport-native-epoll < 4.2.15.Final \n | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.2.15.Final \n | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1784705586.
","user_segment_ids":[]},{"id":52069419082260,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52069419082260.json","html_url":"https://support.confluent.io/hc/en-us/articles/52069419082260-Security-Release-Notes-for-CP-7-9-9-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T06:29:06Z","updated_at":"2026-08-12T21:07:19Z","name":"Security Release Notes for CP 7.9.9 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 7.9.9 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:18Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 7.9.9 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 7.9.9 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 7.9.9. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 7.9.9. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.9/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 7.9.9. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.9/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 7.9.9. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.1.136.Final \n | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.1.136.Final \n | \n
| \n | 8.1 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nstdlib < 1.26.4 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-transport-sctp < 4.1.135.Final | \nio.netty:netty-transport-sctp = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.1.136.Final \n | \n
| \n | 6.5 | \nstdlib < 1.26.4 | \nstdlib = 1.26.5 | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \nstdlib < 1.26.4 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.1.136.Final \n | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.1.136.Final \n | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.135.Final | \n\n io.netty:netty-codec-http = 4.1.135.Final \nio.netty:netty-codec-http = 4.1.136.Final \n | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.1.136.Final \n | \n
| \n | 4.0 | \nio.netty:netty-transport-native-kqueue < 4.1.135.Final | \n\n io.netty:netty-transport-native-kqueue = 4.1.135.Final \nio.netty:netty-transport-native-kqueue = 4.1.136.Final \n | \n
| \n | 4.0 | \nio.netty:netty-transport-native-epoll < 4.1.135.Final | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.1.136.Final \n | \n
This patch release uses Red Hat Universal Base Image 8 Minimal version 8.10-1785302592.
","user_segment_ids":[]},{"id":52069349856660,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52069349856660.json","html_url":"https://support.confluent.io/hc/en-us/articles/52069349856660-Security-Release-Notes-for-CP-7-8-10-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T06:27:01Z","updated_at":"2026-08-12T21:07:19Z","name":"Security Release Notes for CP 7.8.10 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 7.8.10 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:19Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 7.8.10 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 7.8.10 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 7.8.10. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 7.8.10. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.8/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 7.8.10. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.8/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 7.8.10. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.1.136.Final \n | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.1.136.Final \n | \n
| \n | 8.1 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-transport-sctp < 4.1.135.Final | \nio.netty:netty-transport-sctp = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \n\n io.netty:netty-resolver-dns = 4.1.135.Final \nio.netty:netty-resolver-dns = 4.1.136.Final \n | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.1.136.Final \n | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.1.136.Final \n | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.135.Final | \n\n io.netty:netty-codec-http = 4.1.135.Final \nio.netty:netty-codec-http = 4.1.136.Final \n | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \n\n io.netty:netty-codec-http2 = 4.1.135.Final \nio.netty:netty-codec-http2 = 4.1.136.Final \n | \n
| \n | 4.0 | \nio.netty:netty-transport-native-kqueue < 4.1.135.Final | \n\n io.netty:netty-transport-native-kqueue = 4.1.135.Final \nio.netty:netty-transport-native-kqueue = 4.1.136.Final \n | \n
| \n | 4.0 | \nio.netty:netty-transport-native-epoll < 4.1.135.Final | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.1.136.Final \n | \n
This patch release uses Red Hat Universal Base Image 8 Minimal version 8.10-1783573312.
","user_segment_ids":[]},{"id":52069254110228,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52069254110228.json","html_url":"https://support.confluent.io/hc/en-us/articles/52069254110228-Security-Release-Notes-for-CP-7-7-11-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T06:24:11Z","updated_at":"2026-08-12T21:07:21Z","name":"Security Release Notes for CP 7.7.11 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 7.7.11 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:21Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 7.7.11 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 7.7.11 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 7.7.11. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 7.7.11. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.7/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 7.7.11. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.7/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 7.7.11. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 8.1 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-transport-sctp < 4.1.135.Final | \nio.netty:netty-transport-sctp = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.135.Final | \nio.netty:netty-codec-http = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 4.0 | \nio.netty:netty-transport-native-epoll < 4.1.135.Final | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.1.136.Final \n | \n
| \n | 4.0 | \nio.netty:netty-transport-native-kqueue < 4.1.135.Final | \nio.netty:netty-transport-native-kqueue = 4.1.135.Final | \n
This patch release uses Red Hat Universal Base Image 8 Minimal version 8.10-1784730826.
","user_segment_ids":[]},{"id":52069260737044,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52069260737044.json","html_url":"https://support.confluent.io/hc/en-us/articles/52069260737044-Security-Release-Notes-for-CP-7-6-13-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T06:22:35Z","updated_at":"2026-08-12T21:07:23Z","name":"Security Release Notes for CP 7.6.13 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 7.6.13 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:23Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 7.6.13 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 7.6.13 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 7.6.13. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 7.6.13. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.6/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 7.6.13. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.6/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 7.6.13. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 8.1 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-transport-sctp < 4.1.135.Final | \nio.netty:netty-transport-sctp = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.135.Final | \nio.netty:netty-codec-http = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 4.0 | \nio.netty:netty-transport-native-kqueue < 4.1.135.Final | \nio.netty:netty-transport-native-kqueue = 4.1.135.Final | \n
| \n | 4.0 | \nio.netty:netty-transport-native-epoll < 4.1.135.Final | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.1.136.Final \n | \n
This patch release uses Red Hat Universal Base Image 8 Minimal version 8.10-1784730826.
","user_segment_ids":[]},{"id":52068076309396,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/52068076309396.json","html_url":"https://support.confluent.io/hc/en-us/articles/52068076309396-Security-Release-Notes-for-CP-7-5-16-Out-of-band-Critical-Patch-Release","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-08-03T05:24:43Z","updated_at":"2026-08-12T21:07:25Z","name":"Security Release Notes for CP 7.5.16 (Out of band Critical Patch Release)","title":"Security Release Notes for CP 7.5.16 (Out of band Critical Patch Release)","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-08-12T21:07:25Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 7.5.16 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 7.5.16 patch release contains fixes for the following security vulnerabilities:
| \n Vulnerability \nReference \n | \nCVSS | \nAffected Components | \nResolution | \n
| \n\n \n | \n\n CVE-2026-50020 - 5.3 \nCVE-2026-50560 - 5.3 \nCVE-2026-45416 - 7.5 \nCVE-2026-44893 - 7.5 \nCVE-2026-48059 - 7.5 \n | \nNetty | \nThis issue has been fixed in Confluent Platform version 7.5.16. | \n
| \n | 5.9 | \nKafka | \n\n This issue has been fixed in Confluent Platform version 7.5.16. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.5/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls \n | \n
| \n | 5.7 | \nSchema Registry | \n\n This issue has been fixed in Confluent Platform version 7.5.16. \nPlease review the additional required configuration in Confluent Platform documentation below: https://docs.confluent.io/platform/7.5/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas \n | \n
| \n \n CONFSA-2026-16 \nCONFSA-2026-17 \nCONFSA-2026-18 \nCONFSA-2026-19 \nCONFSA-2026-20 \n | \n5.7 | \nKafka | \n\n These issues have been fixed in Confluent Platform version 7.5.16. Additional information will be published in coordination with the Apache Software Foundation along with upcoming Kafka release \n | \n
More information in the following Confluent Security Advisories:
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 8.1 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.8 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-transport-sctp < 4.1.135.Final | \nio.netty:netty-transport-sctp = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.1.135.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.1.135.Final | \n\n io.netty:netty-handler = 4.1.135.Final \nio.netty:netty-handler = 4.1.136.Final \n | \n
| \n | 7.5 | \nio.netty:netty-codec-redis < 4.1.135.Final | \nio.netty:netty-codec-redis = 4.1.135.Final | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 7.5 | \npyasn1 < 0.6.4 | \npyasn1 = 0.6.4 | \n
| \n | 6.8 | \nio.netty:netty-resolver-dns < 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.1.135.Final | \n
| \n | 6.1 | \nsetuptools < 83.0.0 | \nsetuptools = 83.0.0 | \n
| \n | 5.3 | \nstdlib < 1.26.5 | \nstdlib = 1.26.5 | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.135.Final | \nio.netty:netty-codec-http = 4.1.135.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.1.135.Final | \n
| \n | 4.0 | \nio.netty:netty-transport-native-epoll < 4.1.135.Final | \n\n io.netty:netty-transport-native-epoll = 4.1.135.Final \nio.netty:netty-transport-native-epoll = 4.1.136.Final \n | \n
| \n | 4.0 | \nio.netty:netty-transport-native-kqueue < 4.1.135.Final | \nio.netty:netty-transport-native-kqueue = 4.1.135.Final | \n
This patch release uses Red Hat Universal Base Image 8 Minimal version 8.10-1784730826.
","user_segment_ids":[]},{"id":50730711456148,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50730711456148.json","html_url":"https://support.confluent.io/hc/en-us/articles/50730711456148-Security-Release-Notes-for-CPC-Gateway","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-26T17:31:13Z","updated_at":"2026-06-27T15:00:22Z","name":"Security Release Notes for CPC Gateway","title":"Security Release Notes for CPC Gateway","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-26T18:38:17Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"CPC Gateway patch release 1.2.1 addresses security hygiene improvements across CPC Gateway components through upgrades to third-party dependencies.
CPC Gateway 1.2.1 did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.2.15.Final | \n
| \n | 8.7 | \nio.netty:netty-resolver-dns < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.2.15.Final | \n
| \n | 8.2 | \nstdlib < 1.26.2 | \nstdlib = 1.26.4 | \n
| \n | 8.1 | \nio.netty:netty-handler < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-handler = 4.2.15.Final | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.132.Final, 4.2.10.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http2 < 4.1.132.Final, 4.2.11.Final | \nio.netty:netty-codec-http2 = 4.2.15.Final | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.4 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.4 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nio.netty:netty-transport-native-epoll < 4.2.13.Final | \nio.netty:netty-transport-native-epoll = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-handler-proxy < 4.1.133.Final, 4.2.13.Final | \nio.netty:netty-handler-proxy = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-dns < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-dns = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-compression < 4.2.13.Final | \nio.netty:netty-codec-compression = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http2 < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http2 = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-handler = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-haproxy < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-codec-haproxy = 4.2.15.Final | \n
| \n | 7.5 | \nio.netty:netty-handler < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-handler = 4.2.15.Final | \n
| \n | 7.3 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 6.9 | \ncom.fasterxml.jackson.core:jackson-core < 2.21.1, 2.18.6 | \ncom.fasterxml.jackson.core:jackson-core = 2.18.6, 2.21.1 | \n
| \n | 6.8 | \nio.netty:netty-resolver-dns < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-resolver-dns = 4.2.15.Final | \n
| \n | 6.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.26.4 | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.4 | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.4 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 5.9 | \norg.apache.logging.log4j:log4j-core < 2.25.4 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 5.8 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.4 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.133.Final, 4.2.13.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 5.3 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.26.4 | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.2.15.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.1.135.Final, 4.2.15.Final | \nio.netty:netty-codec-http2 = 4.2.15.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-codec-http = 4.2.15.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http2 < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-codec-http2 = 4.2.15.Final | \n
| \n | 4.8 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 4.0 | \nio.netty:netty-transport-native-epoll < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-transport-native-epoll = 4.2.15.Final | \n
| \n | 4.0 | \nio.netty:netty-transport-native-kqueue < 4.2.15.Final, 4.1.135.Final | \nio.netty:netty-transport-native-kqueue = 4.2.15.Final | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.46.0 | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1782191395.
","user_segment_ids":[]},{"id":50625922683412,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50625922683412.json","html_url":"https://support.confluent.io/hc/en-us/articles/50625922683412-Security-Release-Notes-for-USM-agent","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-24T06:23:06Z","updated_at":"2026-06-29T16:02:40Z","name":"Security Release Notes for USM agent","title":"Security Release Notes for USM agent","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-29T07:06:11Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"USM Agent patch release 1.0.2 addresses security hygiene improvements across USM Agent components through upgrades to third-party dependencies.
USM Agent 1.0.2 did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 10.0 | \nstdlib < 1.24.13, 1.25.7, 1.26.0-rc.3 | \nstdlib = 1.25.10 | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.81.0 | \n
| \n | 7.5 | \nstdlib < 1.24.12, 1.25.6 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.54.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 6.5 | \nstdlib < 1.24.12, 1.25.6 | \nstdlib = 1.25.10 | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 6.1 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.10 | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 5.3 | \ngolang.org/x/net < 0.45.0 | \ngolang.org/x/net = 0.54.0 | \n
| \n | 5.3 | \ngolang.org/x/net < 0.45.0 | \ngolang.org/x/net = 0.54.0 | \n
| \n | 5.3 | \nstdlib < 1.24.12, 1.25.6 | \nstdlib = 1.25.10 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 2.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.10 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.44.0 | \n
This patch release uses Red Hat Universal Base Image 9 Micro version 9.8-1779858820.
USM Agent patch release 1.1.1 addresses security hygiene improvements across USM Agent components through upgrades to third-party dependencies.
USM Agent 1.1.1 did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.81.0 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.54.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.10 | \n
| \n | 5.3 | \ngolang.org/x/net < 0.45.0 | \ngolang.org/x/net = 0.54.0 | \n
| \n | 5.3 | \ngolang.org/x/net < 0.45.0 | \ngolang.org/x/net = 0.54.0 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.10 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.44.0 | \n
This patch release uses Red Hat Universal Base Image 9 Micro version 9.8-1782363471.
","user_segment_ids":[]},{"id":50601171667092,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50601171667092.json","html_url":"https://support.confluent.io/hc/en-us/articles/50601171667092-Security-Release-Notes-for-CFK-3-2-3","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-23T17:16:37Z","updated_at":"2026-06-25T17:24:48Z","name":"Security Release Notes for CFK 3.2.3","title":"Security Release Notes for CFK 3.2.3","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-25T16:22:30Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent for Kubernetes (CFK) patch release 3.2.3 addresses security hygiene improvements across CFK components through upgrades to third-party dependencies.
This CFK release version did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.6 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 8.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 8.8 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 8.2 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 8.1 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 7.5 | \ngo.opentelemetry.io/otel < 1.41.0 | \ngo.opentelemetry.io/otel = 1.43.0 | \n
| \n | 7.5 | \ngithub.com/buger/jsonparser < 1.1.2 | \ngithub.com/buger/jsonparser = 1.1.2 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v4 < 4.1.4 | \ngithub.com/go-jose/go-jose/v4 = 4.1.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-git/go-git/v5 < 5.19.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 7.4 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.1 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 6.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 6.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.5 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 6.5 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.0 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 5.4 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 5.3 | \nidna < 3.15 | \nidna = Removed | \n
| \n | 5.3 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 4.4 | \nrequests < 2.33.0 | \nrequests = Removed | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.45.0, 0.46.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
This patch release version depends upon Red Hat Universal Base Image 9 Micro version 9.8-1779858820.
","user_segment_ids":[]},{"id":50601108503188,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50601108503188.json","html_url":"https://support.confluent.io/hc/en-us/articles/50601108503188-Security-Release-Notes-for-CFK-3-1-3","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-23T17:14:26Z","updated_at":"2026-06-25T17:24:29Z","name":"Security Release Notes for CFK 3.1.3","title":"Security Release Notes for CFK 3.1.3","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-25T16:24:05Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent for Kubernetes (CFK) patch release 3.1.3 addresses security hygiene improvements across CFK components through upgrades to third-party dependencies.
This CFK release version did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \ngithub.com/cloudflare/circl < 1.6.3 | \ngithub.com/cloudflare/circl = 1.6.3 | \n
| \n | 9.6 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.80.0, 1.81.1 | \n
| \n | 8.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 8.8 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 8.2 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 8.1 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 7.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngo.opentelemetry.io/otel < 1.41.0 | \ngo.opentelemetry.io/otel = 1.43.0, 1.44.0 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/buger/jsonparser < 1.1.2 | \ngithub.com/buger/jsonparser = 1.1.2 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v3 < 3.0.5 | \ngithub.com/go-jose/go-jose/v3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v4 < 4.1.4 | \ngithub.com/go-jose/go-jose/v4 = 4.1.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-git/go-git/v5 < 5.19.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 7.4 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.1 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.40.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.43.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 6.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 6.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.5 | \ngithub.com/moby/spdystream < 0.5.1 | \ngithub.com/moby/spdystream = 0.5.1 | \n
| \n | 6.5 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 6.5 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.0 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.4 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp < 1.43.0 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp = 1.44.0 | \n
| \n | 5.3 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 5.3 | \nidna < 3.15 | \nidna = Removed | \n
| \n | 5.3 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | 5.0 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.7 | \ngithub.com/go-git/go-git/v5 < 5.18.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.4 | \nrequests < 2.33.0 | \nrequests = Removed | \n
| \n | 2.8 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 2.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.45.0, 0.46.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.52.0, 0.53.0 | \n
This patch release version depends upon Red Hat Universal Base Image 9 Micro version 9.8-1779858820.
","user_segment_ids":[]},{"id":50600977368212,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50600977368212.json","html_url":"https://support.confluent.io/hc/en-us/articles/50600977368212-Security-Release-Notes-for-CFK-3-0-5","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-23T17:12:12Z","updated_at":"2026-06-25T17:24:06Z","name":"Security Release Notes for CFK 3.0.5","title":"Security Release Notes for CFK 3.0.5","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-25T16:24:39Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent for Kubernetes (CFK) patch release 3.0.5 addresses security hygiene improvements across CFK components through upgrades to third-party dependencies.
This CFK release version did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \ngithub.com/cloudflare/circl < 1.6.3 | \ngithub.com/cloudflare/circl = 1.6.3 | \n
| \n | 9.6 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.80.0, 1.81.1 | \n
| \n | 8.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 8.8 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 8.2 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 8.1 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 7.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngo.opentelemetry.io/otel < 1.41.0 | \ngo.opentelemetry.io/otel = 1.43.0, 1.44.0 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/buger/jsonparser < 1.1.2 | \ngithub.com/buger/jsonparser = 1.1.2 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v4 < 4.1.4 | \ngithub.com/go-jose/go-jose/v4 = 4.1.4 | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v3 < 3.0.5 | \ngithub.com/go-jose/go-jose/v3 = Removed | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-git/go-git/v5 < 5.19.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 7.4 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.1 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.40.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.43.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 6.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 6.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.5 | \ngithub.com/moby/spdystream < 0.5.1 | \ngithub.com/moby/spdystream = 0.5.1 | \n
| \n | 6.5 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 6.5 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.0 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.4 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp < 1.43.0 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp = 1.44.0 | \n
| \n | 5.3 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 5.3 | \nidna < 3.15 | \nidna = Removed | \n
| \n | 5.3 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 5.0 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.7 | \ngithub.com/go-git/go-git/v5 < 5.18.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.4 | \nrequests < 2.33.0 | \nrequests = Removed | \n
| \n | 2.8 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 2.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.46.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
This patch release version depends upon Red Hat Universal Base Image 9 Micro version 9.8-1779858820.
","user_segment_ids":[]},{"id":50600837925012,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50600837925012.json","html_url":"https://support.confluent.io/hc/en-us/articles/50600837925012-Security-Release-Notes-for-CFK-2-11-6","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-23T17:09:36Z","updated_at":"2026-06-25T17:23:49Z","name":"Security Release Notes for CFK 2.11.6","title":"Security Release Notes for CFK 2.11.6","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-25T16:31:11Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent for Kubernetes (CFK) patch release 2.11.6 addresses security hygiene improvements across CFK components through upgrades to third-party dependencies.
This CFK release version did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \ngithub.com/cloudflare/circl < 1.6.3 | \ngithub.com/cloudflare/circl = 1.6.3 | \n
| \n | 9.6 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.80.0, 1.81.1 | \n
| \n | 8.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 8.8 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 8.2 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 8.1 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 7.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngo.opentelemetry.io/otel < 1.41.0 | \ngo.opentelemetry.io/otel = 1.43.0, 1.44.0 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/buger/jsonparser < 1.1.2 | \ngithub.com/buger/jsonparser = 1.1.2 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v3 < 3.0.5 | \ngithub.com/go-jose/go-jose/v3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v4 < 4.1.4 | \ngithub.com/go-jose/go-jose/v4 = 4.1.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-git/go-git/v5 < 5.19.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 7.4 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.1 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.40.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.43.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 6.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 6.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.5 | \ngithub.com/moby/spdystream < 0.5.1 | \ngithub.com/moby/spdystream = 0.5.1 | \n
| \n | 6.5 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 6.5 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.0 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.4 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp < 1.43.0 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp = 1.44.0 | \n
| \n | 5.3 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 5.3 | \nidna < 3.15 | \nidna = Removed | \n
| \n | 5.3 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 5.0 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.7 | \ngithub.com/go-git/go-git/v5 < 5.18.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.4 | \nrequests < 2.33.0 | \nrequests = Removed | \n
| \n | 2.8 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 2.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.46.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
This patch release version depends upon Red Hat Universal Base Image 9 Micro version 8.10-1779859061.
","user_segment_ids":[]},{"id":50600307947796,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50600307947796.json","html_url":"https://support.confluent.io/hc/en-us/articles/50600307947796-Security-Release-Notes-for-CFK-2-10-6","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-23T16:58:58Z","updated_at":"2026-06-25T17:23:30Z","name":"Security Release Notes for CFK 2.10.6","title":"Security Release Notes for CFK 2.10.6","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-25T16:29:56Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent for Kubernetes (CFK) patch release 2.10.6 addresses security hygiene improvements across CFK components through upgrades to third-party dependencies.
This CFK release version did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \ngithub.com/cloudflare/circl < 1.6.3 | \ngithub.com/cloudflare/circl = 1.6.3 | \n
| \n | 9.6 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.80.0, 1.81.1 | \n
| \n | 8.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 8.8 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 8.2 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 8.1 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 7.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngo.opentelemetry.io/otel < 1.41.0 | \ngo.opentelemetry.io/otel = 1.43.0, 1.44.0 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/buger/jsonparser < 1.1.2 | \ngithub.com/buger/jsonparser = 1.1.2 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v3 < 3.0.5 | \ngithub.com/go-jose/go-jose/v3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v4 < 4.1.4 | \ngithub.com/go-jose/go-jose/v4 = 4.1.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-git/go-git/v5 < 5.19.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 7.4 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.1 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.40.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.43.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 6.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 6.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.5 | \ngithub.com/moby/spdystream < 0.5.1 | \ngithub.com/moby/spdystream = 0.5.1 | \n
| \n | 6.5 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 6.5 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.0 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.4 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp < 1.43.0 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp = 1.44.0 | \n
| \n | 5.3 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 5.3 | \nidna < 3.15 | \nidna = Removed | \n
| \n | 5.3 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 5.0 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.7 | \ngithub.com/go-git/go-git/v5 < 5.18.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.4 | \nrequests < 2.33.0 | \nrequests = Removed | \n
| \n | 2.8 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 2.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.46.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
This patch release version depends upon Red Hat Universal Base Image 9 Micro version 8.10-1779859061.
","user_segment_ids":[]},{"id":50600166194324,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50600166194324.json","html_url":"https://support.confluent.io/hc/en-us/articles/50600166194324-Security-Release-Notes-for-CFK-2-9-10","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-23T16:56:28Z","updated_at":"2026-06-25T17:23:14Z","name":"Security Release Notes for CFK 2.9.10","title":"Security Release Notes for CFK 2.9.10","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-25T16:20:55Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent for Kubernetes (CFK) patch release 2.9.10 addresses security hygiene improvements across CFK components through upgrades to third-party dependencies.
This CFK release version did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \ngithub.com/cloudflare/circl < 1.6.3 | \ngithub.com/cloudflare/circl = 1.6.3 | \n
| \n | 9.6 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.80.0, 1.81.1 | \n
| \n | 8.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 8.8 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 8.2 | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 8.1 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 8.1 | \ncom.fasterxml.jackson.core:jackson-databind < 2.18.8, 3.1.4, 2.21.4 | \ncom.fasterxml.jackson.core:jackson-databind = Removed | \n
| \n | 8.1 | \ncom.fasterxml.jackson.core:jackson-databind < 2.18.8, 2.21.4, 3.1.4 | \ncom.fasterxml.jackson.core:jackson-databind = Removed | \n
| \n | 7.5 | \norg.apache.zookeeper:zookeeper < 3.9.5, 3.8.6 | \norg.apache.zookeeper:zookeeper = Removed | \n
| \n | 7.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngo.opentelemetry.io/otel < 1.41.0 | \ngo.opentelemetry.io/otel = 1.43.0, 1.44.0 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngithub.com/buger/jsonparser < 1.1.2 | \ngithub.com/buger/jsonparser = 1.1.2 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/net < 0.53.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v4 < 4.1.4 | \ngithub.com/go-jose/go-jose/v4 = 4.1.4 | \n
| \n | 7.5 | \ngithub.com/go-jose/go-jose/v3 < 3.0.5 | \ngithub.com/go-jose/go-jose/v3 = Removed | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 7.5 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 7.5 | \ngithub.com/go-git/go-git/v5 < 5.19.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 7.4 | \norg.apache.zookeeper:zookeeper < 3.8.6, 3.9.5 | \norg.apache.zookeeper:zookeeper = Removed | \n
| \n | 7.4 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.1 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.40.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.43.0 | \ngo.opentelemetry.io/otel/sdk = 1.44.0 | \n
| \n | 6.9 | \ncom.fasterxml.jackson.core:jackson-core < 2.21.1, 2.18.6 | \ncom.fasterxml.jackson.core:jackson-core = Removed | \n
| \n | 6.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 6.6 | \npython-dotenv < 1.2.2 | \npython-dotenv = Removed | \n
| \n | 6.5 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.5 | \ngithub.com/moby/spdystream < 0.5.1 | \ngithub.com/moby/spdystream = 0.5.1 | \n
| \n | 6.5 | \ngithub.com/go-git/go-billy/v5 < 5.9.0 | \ngithub.com/go-git/go-billy/v5 = 5.9.0 | \n
| \n | 6.5 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 6.0 | \ngithub.com/docker/docker = 28.0.0+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.4 | \ngithub.com/go-git/go-git/v5 < 5.19.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp < 1.43.0 | \ngo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp = 1.44.0 | \n
| \n | 5.3 | \nstdlib < 1.25.11, 1.26.4 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | 5.3 | \nurllib3 < 2.7.0 | \nurllib3 = Removed | \n
| \n | 5.3 | \nidna < 3.15 | \nidna = Removed | \n
| \n | 5.3 | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | 5.3 | \ncom.fasterxml.jackson.core:jackson-databind < 2.18.8, 2.21.4, 3.1.4 | \ncom.fasterxml.jackson.core:jackson-databind = Removed | \n
| \n | 5.3 | \ncom.fasterxml.jackson.core:jackson-databind < 3.1.4, 2.18.9, 2.21.5 | \ncom.fasterxml.jackson.core:jackson-databind = Removed | \n
| \n | 5.0 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.7 | \ngithub.com/go-git/go-git/v5 < 5.18.0 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 4.4 | \nrequests < 2.33.0 | \nrequests = Removed | \n
| \n | 2.8 | \ngithub.com/go-git/go-git/v5 < 5.17.1 | \ngithub.com/go-git/go-git/v5 = 5.19.1 | \n
| \n | 2.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.25.11, 1.26.4-X:boringcrypto | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/sys < 0.44.0 | \ngolang.org/x/sys = 0.46.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/net < 0.55.0 | \ngolang.org/x/net = 0.55.0 | \n
| \n | n/a | \ngolang.org/x/crypto < 0.52.0 | \ngolang.org/x/crypto = 0.53.0 | \n
This patch release version depends upon Red Hat Universal Base Image 9 Micro version 8.10-1779859061.
","user_segment_ids":[]},{"id":50559302978068,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50559302978068.json","html_url":"https://support.confluent.io/hc/en-us/articles/50559302978068-CONFSA-2026-12-Confluent-Platform-And-Confluent-Cloud-Denial-Of-Service-Via-Improper-Handling-Of-Telemetry-Data","author_id":5842944700052,"comments_disabled":false,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-22T19:33:26Z","updated_at":"2026-06-23T15:00:09Z","name":"CONFSA-2026-12: Confluent Platform And Confluent Cloud: Denial Of Service Via Improper Handling Of Telemetry Data","title":"CONFSA-2026-12: Confluent Platform And Confluent Cloud: Denial Of Service Via Improper Handling Of Telemetry Data","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-22T21:29:29Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"A security vulnerability affecting both Confluent Platform and Confluent Cloud has been identified, caused by improper handling of telemetry that the Kafka broker receives from Kafka clients. As a result of this flaw, processing maliciously crafted client telemetry can cause memory exhaustion on the Kafka broker, leading to a loss of availability.
There are currently no known mitigations.
This issue is resolved in the CP patch release versions 7.8.9, 7.9.8, 8.0.6, 8.1.4, 8.2.2. Please upgrade to Confluent Platform versions 7.8.9, 7.9.8, 8.0.6, 8.1.4, 8.2.2.
A security vulnerability affecting both Confluent Platform and Confluent Cloud has been identified, caused by improper handling of compressed data schemas. As a result of this flaw, processing a maliciously crafted schema can cause memory exhaustion in the Schema Registry, leading to a potential loss of availability.
Until you are able to upgrade and enable the size-limit filter, you can reduce your exposure by enforcing a maximum request body size at an upstream reverse proxy, load balancer, or API gateway placed in front of Schema Registry (for example, client_max_body_size in nginx). You should also restrict network access to the schema registration endpoints so that only trusted clients can reach them, and require authentication wherever possible.
Please upgrade to Confluent Platform versions 7.5.15, 7.6.12, 7.7.10,7.8.9, 7.9.8, 8.0.6, 8.1.4, 8.2.2, and set up two new configuration directives:
This vulnerability was responsibly reported and disclosed by Oleh Konko of 1seal.
","user_segment_ids":[]},{"id":50559212116884,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50559212116884.json","html_url":"https://support.confluent.io/hc/en-us/articles/50559212116884-CONFSA-2026-10-CVE-2026-24281-Confluent-Platform-Impersonation-Of-ZooKeeper-Servers-Or-Clients-Via-Reverse-DNS-Spoofing","author_id":5842944700052,"comments_disabled":false,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-22T19:32:04Z","updated_at":"2026-06-23T15:00:08Z","name":"CONFSA-2026-10: CVE-2026-24281: Confluent Platform: Impersonation Of ZooKeeper Servers Or Clients Via Reverse DNS Spoofing","title":"CONFSA-2026-10: CVE-2026-24281: Confluent Platform: Impersonation Of ZooKeeper Servers Or Clients Via Reverse DNS Spoofing","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-22T21:40:32Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"A security vulnerability affecting Confluent Platform has been identified, stemming from a flaw in ZooKeeper, a third-party open-source component. Because of this flaw, ZooKeeper servers and clients could be instantiated in a way that allows them to connect to an untrusted ZooKeeper server, potentially resulting in a loss of data confidentiality and integrity.
Upgrade to a fixed Confluent Platform version. If an immediate upgrade isn't feasible, we recommend applying the following hardening measures to significantly reduce the potential for exploitation:
Upgrade to Confluent Platform version: 7.5.15, 7.6.12, 7.7.10, 7.8.9, 7.9.8.
A security issue has been identified to impact Confluent Platform caused by a flaw in the Open Source, third-party component ZooKeeper. Due to this issue, an instantiation of Confluent Platform components can result in un-obfuscated sensitive information to be displayed in standard output and exposed to any downstream logging pipelines.
There are currently no known mitigations.
This issue is resolved in the CP patch release versions 7.5.15, 7.6.12, 7.7.10, 7.8.9, 7.9.8. The updated version of the third-party dependency ZooKeeper adequately addresses this issue, as the vulnerable logging statement was removed. Please upgrade to Confluent Platform versions 7.5.15, 7.6.12, 7.7.10, 7.8.9, 7.9.8.
","user_segment_ids":[]},{"id":50433207693332,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50433207693332.json","html_url":"https://support.confluent.io/hc/en-us/articles/50433207693332-Security-Release-Notes-for-Control-Center-Next-Generation","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-18T17:42:06Z","updated_at":"2026-06-25T17:18:32Z","name":"Security Release Notes for Control Center Next Generation","title":"Security Release Notes for Control Center Next Generation","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-25T16:37:59Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"
Control Center Next Generation patch release 2.5.1 addresses security hygiene improvements across Control Center Next Generation components through upgrades to third-party dependencies.
Control Center Next Generation 2.5.1 did not include any upgrades related to exploitable security vulnerabilities.
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.1 | \ngoogle.golang.org/grpc < 1.79.3 | \ngoogle.golang.org/grpc = 1.80.0, 1.81.1 | \n
| \n | 8.8 | \norg.codehaus.plexus:plexus-utils < 4.0.3, 3.6.1 | \norg.codehaus.plexus:plexus-utils = 4.0.3 | \n
| \n | 8.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 8.2 | \nstdlib < 1.26.2 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \norg.eclipse.jetty:jetty-server < 12.1.6, 12.0.32 | \norg.eclipse.jetty:jetty-server = 12.0.35 | \n
| \n | 7.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.26.1 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \ngo.opentelemetry.io/otel < 1.41.0 | \ngo.opentelemetry.io/otel = 1.41.0, 1.44.0 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \ngithub.com/buger/jsonparser < 1.1.2 | \ngithub.com/buger/jsonparser = 1.1.2 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.132.Final, 4.2.10.Final | \nio.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http2 < 4.1.132.Final, 4.2.11.Final | \nio.netty:netty-codec-http2 = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.4 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.4 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 7.5 | \nio.netty:netty-handler-proxy < 4.1.133.Final, 4.2.13.Final | \nio.netty:netty-handler-proxy = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-dns < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-dns = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec < 4.1.133.Final | \nio.netty:netty-codec = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http2 < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http2 = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.4 | \norg.eclipse.jetty:jetty-http < 12.1.7, 12.0.33 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 7.4 | \norg.asynchttpclient:async-http-client < 3.0.10, 2.15.0 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 7.3 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.5.2+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.2 | \ngithub.com/docker/docker = 28.5.2+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 7.0 | \ngo.opentelemetry.io/otel/sdk < 1.40.0 | \ngo.opentelemetry.io/otel/sdk = 1.41.0, 1.44.0 | \n
| \n | 6.9 | \ncom.fasterxml.jackson.core:jackson-core < 2.21.1, 2.18.6 | \ncom.fasterxml.jackson.core:jackson-core = 2.21.2 | \n
| \n | 6.8 | \ngithub.com/docker/docker < 29.3.1 | \ngithub.com/docker/docker = Removed | \n
| \n | 6.8 | \norg.asynchttpclient:async-http-client < 3.0.9, 2.14.5 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 6.5 | \ngo.mongodb.org/mongo-driver < 1.17.7 | \ngo.mongodb.org/mongo-driver = Removed | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final | \n
| \n | 6.4 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 6.1 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 6.1 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 6.1 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 6.1 | \ngithub.com/prometheus/prometheus < 0.311.2-0.20260410083055-07c6232d159b | \ngithub.com/prometheus/prometheus = 3.12.0 | \n
| \n | 6.0 | \ngithub.com/docker/docker = 28.5.2+incompatible | \ngithub.com/docker/docker = Removed | \n
| \n | 5.9 | \nstdlib < 1.26.1 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 5.9 | \norg.apache.logging.log4j:log4j-core < 2.25.4 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 5.8 | \nio.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final | \nio.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final | \n
| \n | 5.5 | \nstdlib < 1.25.9, 1.26.2 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 5.3 | \nstdlib < 1.25.10, 1.26.3 | \nstdlib = 1.26.3, 1.26.4 | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.133.Final, 4.2.13.Final | \nio.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final | \n
| \n | 3.7 | \norg.eclipse.jetty:jetty-http < 12.0.31, 12.1.5 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 2.5 | \nstdlib < 1.25.8, 1.26.1 | \nstdlib = 1.26.3, 1.26.4 | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1780378819.
","user_segment_ids":[]},{"id":50383787516180,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50383787516180.json","html_url":"https://support.confluent.io/hc/en-us/articles/50383787516180-Security-Release-Notes-for-CP-8-2-2","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-17T13:33:35Z","updated_at":"2026-06-22T21:45:19Z","name":"Security Release Notes for CP 8.2.2","title":"Security Release Notes for CP 8.2.2","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-22T21:45:16Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 8.2.2 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 8.2.2 patch release contains fix for the following security vulnerabilities:
Vulnerability | \nCVSS | \nAffected Components | \nResolution | \n
| \n | 5.7 | \nSchema registry | \nThis issue has been fixed in Confluent Platform version 8.2.2. | \n
| \n | 5.7 | \nConfluent Platform Server | \nThis issue has been fixed in Confluent Platform version 8.2.2. | \n
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.2.13.Final | \n
| \n | 9.1 | \norg.eclipse.jetty:jetty-http < 12.0.25 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 9.1 | \nio.netty:netty-codec-dns < 4.1.130.Final | \nio.netty:netty-codec-dns = 4.2.13.Final | \n
| \n | 9.1 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.2.13.Final | \n
| \n | 8.8 | \norg.codehaus.plexus:plexus-utils < 3.5.1 | \norg.codehaus.plexus:plexus-utils = 4.0.3 | \n
| \n | 8.7 | \nio.netty:netty-codec-http2 < 4.1.130.Final | \nio.netty:netty-codec-http2 = 4.2.13.Final | \n
| \n | 7.5 | \norg.eclipse.jetty:jetty-server < 12.0.25 | \norg.eclipse.jetty:jetty-server = 12.0.35 | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.2.13.Final | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-1.2-api < 2.25.3 | \norg.apache.logging.log4j:log4j-1.2-api = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-layout-template-json < 2.25.3 | \norg.apache.logging.log4j:log4j-layout-template-json = 2.25.4 | \n
| \n | 7.5 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nio.netty:netty-handler-proxy < 4.1.130.Final | \nio.netty:netty-handler-proxy = 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec < 4.1.130.Final | \nio.netty:netty-codec = 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.2.13.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.2.13.Final | \n
| \n | 7.4 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 6.9 | \ncom.fasterxml.jackson.core:jackson-core < 2.19.0 | \ncom.fasterxml.jackson.core:jackson-core = 2.21.2 | \n
| \n | 6.9 | \nidna < 3.13 | \nidna = 3.18 | \n
| \n | 6.8 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 6.8 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 6.5 | \norg.eclipse.jetty:jetty-http < 12.0.25 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 6.5 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.2.13.Final | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.2.13.Final | \n
| \n | 5.3 | \nio.vertx:vertx-core < 4.5.24 | \nio.vertx:vertx-core = 4.5.27 | \n
| \n | 5.3 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 5.3 | \norg.apache.commons:commons-configuration2 < 2.12.0 | \norg.apache.commons:commons-configuration2 = 2.15.0 | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1780378819.
","user_segment_ids":[]},{"id":50383679868948,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50383679868948.json","html_url":"https://support.confluent.io/hc/en-us/articles/50383679868948-Security-Release-Notes-for-CP-8-1-4","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-17T13:30:56Z","updated_at":"2026-06-22T21:45:15Z","name":"Security Release Notes for CP 8.1.4","title":"Security Release Notes for CP 8.1.4","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-22T21:45:13Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 8.1.4 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 8.1.4 patch release contains fix for the following security vulnerabilities:
Vulnerability | \nCVSS | \nAffected Components | \nResolution | \n
| \n | 5.7 | \nSchema Registry | \nThis issue has been fixed in Confluent Platform version 8.1.4. | \n
| \n | 5.7 | \nConfluent Platform Server | \nThis issue has been fixed in Confluent Platform version 8.1.4. | \n
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 9.1 | \norg.eclipse.jetty:jetty-http < 12.0.25 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 9.1 | \nio.netty:netty-codec-dns < 4.1.130.Final | \nio.netty:netty-codec-dns = 4.1.133.Final | \n
| \n | 9.1 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 8.8 | \norg.codehaus.plexus:plexus-utils < 3.5.1 | \norg.codehaus.plexus:plexus-utils = 4.0.3 | \n
| \n | 7.5 | \norg.eclipse.jetty:jetty-server < 12.0.25 | \norg.eclipse.jetty:jetty-server = 12.0.35 | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http2 < 4.1.130.Final | \nio.netty:netty-codec-http2 = 4.1.133.Final | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-1.2-api < 2.25.3 | \norg.apache.logging.log4j:log4j-1.2-api = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-layout-template-json < 2.25.3 | \norg.apache.logging.log4j:log4j-layout-template-json = 2.25.4 | \n
| \n | 7.5 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nio.netty:netty-handler-proxy < 4.1.130.Final | \nio.netty:netty-handler-proxy = 4.1.133Final | \n
| \n | 7.5 | \nio.netty:netty-codec < 4.1.130.Final | \nio.netty:netty-codec = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.4 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 6.9 | \ncom.fasterxml.jackson.core:jackson-core < 2.16.0 | \ncom.fasterxml.jackson.core:jackson-core = 2.18.6 | \n
| \n | 6.8 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 6.5 | \norg.eclipse.jetty:jetty-http < 12.0.25 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 6.5 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 5.9 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 5.3 | \nio.vertx:vertx-core < 4.5.24 | \nio.vertx:vertx-core = 4.5.27 | \n
| \n | 5.3 | \norg.apache.commons:commons-configuration2 < 2.11.0 | \norg.apache.commons:commons-configuration2 = 2.15.0 | \n
| \n | 5.3 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 5.3 | \nidna < 3.13 | \nidna = 3.18 | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1780378819.
","user_segment_ids":[]},{"id":50383613193492,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50383613193492.json","html_url":"https://support.confluent.io/hc/en-us/articles/50383613193492-Security-Release-Notes-for-CP-8-0-6","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-17T13:29:34Z","updated_at":"2026-06-22T21:45:12Z","name":"Security Release Notes for CP 8.0.6","title":"Security Release Notes for CP 8.0.6","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-22T21:45:09Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 8.0.6 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 8.0.6 patch release contains fix for the following security vulnerabilities:
Vulnerability | \nCVSS | \nAffected Components | \nResolution | \n
| \n | 5.7 | \nSchema Registry | \nThis issue has been fixed in Confluent Platform version 8.0.6. | \n
| \n | 5.7 | \nConfluent Platform Server | \nThis issue has been fixed in Confluent Platform version 8.0.6. | \n
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 9.1 | \norg.eclipse.jetty:jetty-http < 12.0.25 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 9.1 | \nio.netty:netty-codec-dns < 4.1.130.Final | \nio.netty:netty-codec-dns = 4.1.133.Final | \n
| \n | 9.1 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 8.9 | \norg.bouncycastle:bcprov-jdk18on < 1.82 | \norg.bouncycastle:bcprov-jdk18on = 1.84 | \n
| \n | 8.8 | \norg.codehaus.plexus:plexus-utils < 3.5.1 | \norg.codehaus.plexus:plexus-utils = 4.0.3 | \n
| \n | 7.5 | \norg.eclipse.jetty:jetty-server < 12.0.25 | \norg.eclipse.jetty:jetty-server = 12.0.35 | \n
| \n | 7.5 | \norg.bouncycastle:bcpkix-jdk18on < 1.82 | \norg.bouncycastle:bcpkix-jdk18on = 1.84 | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http2 < 4.1.130.Final | \nio.netty:netty-codec-http2 = 4.1.133.Final | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-1.2-api < 2.25.3 | \norg.apache.logging.log4j:log4j-1.2-api = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 7.5 | \norg.apache.logging.log4j:log4j-layout-template-json < 2.25.3 | \norg.apache.logging.log4j:log4j-layout-template-json = 2.25.4 | \n
| \n | 7.5 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 7.5 | \nio.netty:netty-handler-proxy < 4.1.130.Final | \nio.netty:netty-handler-proxy = 4.1.133Final | \n
| \n | 7.5 | \nio.netty:netty-codec < 4.1.130.Final | \nio.netty:netty-codec = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.4 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 6.9 | \ncom.fasterxml.jackson.core:jackson-core < 2.16.0 | \ncom.fasterxml.jackson.core:jackson-core = 2.18.6 | \n
| \n | 6.8 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 3.0.10 | \n
| \n | 6.5 | \norg.eclipse.jetty:jetty-http < 12.0.25 | \norg.eclipse.jetty:jetty-http = 12.0.35 | \n
| \n | 6.5 | \norg.bouncycastle:bcprov-jdk18on < 1.82 | \norg.bouncycastle:bcprov-jdk18on = 1.84 | \n
| \n | 6.5 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 5.9 | \norg.apache.logging.log4j:log4j-core < 2.25.3 | \norg.apache.logging.log4j:log4j-core = 2.25.4 | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 5.3 | \nio.vertx:vertx-core < 4.5.24 | \nio.vertx:vertx-core = 4.5.27 | \n
| \n | 5.3 | \norg.apache.commons:commons-configuration2 < 2.11.0 | \norg.apache.commons:commons-configuration2 = 2.15.0 | \n
| \n | 5.3 | \nstdlib < v1.26.3 | \nstdlib = 1.26.4 | \n
| \n | 5.3 | \nidna < 3.13 | \nidna = 3.18 | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1780378819.
","user_segment_ids":[]},{"id":50383520154772,"url":"https://confluent.zendesk.com/api/v2/help_center/en-us/articles/50383520154772.json","html_url":"https://support.confluent.io/hc/en-us/articles/50383520154772-Security-Release-Notes-for-CP-7-9-8","author_id":17871159299732,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":360008413952,"created_at":"2026-06-17T13:26:44Z","updated_at":"2026-06-22T21:45:07Z","name":"Security Release Notes for CP 7.9.8","title":"Security Release Notes for CP 7.9.8","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-06-22T21:45:05Z","user_segment_id":null,"permission_group_id":4261871,"content_tag_ids":[],"label_names":["everyone"],"body":"Confluent Platform patch release version 7.9.8 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Confluent Platform 7.9.8 patch release contains fix for the following security vulnerabilities:
Vulnerability | \nCVSS | \nAffected Components | \nResolution | \n
CVE-2026-24308 | \n4.5 | \nZooKeeper | \nThis issue has been fixed in Confluent Platform version 7.9.8. | \n
CVE-2026-24281 | \n5.7 | \nZooKeeper | \nThis issue has been fixed in Confluent Platform version 7.9.8. | \n
| \n | 5.7 | \nSchema Registry | \nThis issue has been fixed in Confluent Platform version 7.9.8. | \n
| \n | 5.7 | \nConfluent Platform Server | \nThis issue has been fixed in Confluent Platform version 7.9.8. | \n
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE | \nCVSS | \nImpacted Package Version | \nUpgraded Package Version | \n
| \n | 9.8 | \norg.apache.mina:mina-core < 2.2.4 | \norg.apache.mina:mina-core = 2.2.7 | \n
| \n | 9.8 | \norg.apache.mina:mina-core < 2.2.4 | \norg.apache.mina:mina-core = 2.2.7 | \n
| \n | 9.8 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 9.8 | \norg.apache.mina:mina-core < 2.2.4 | \norg.apache.mina:mina-core = 2.2.7 | \n
| \n | 9.8 | \norg.apache.mina:mina-core < 2.2.4 | \norg.apache.mina:mina-core = 2.2.7 | \n
| \n | 9.1 | \norg.eclipse.jetty:jetty-http < 9.4.59 | \norg.eclipse.jetty:jetty-http = 9.4.61 | \n
| \n | 9.1 | \nio.netty:netty-codec-dns < 4.1.130.Final | \nio.netty:netty-codec-dns = 4.1.133.Final | \n
| \n | 9.1 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 8.9 | \norg.bouncycastle:bcprov-jdk18on < 1.82 | \norg.bouncycastle:bcprov-jdk18on = 1.84 | \n
| \n | 8.8 | \norg.codehaus.plexus:plexus-utils < 3.3.1 | \norg.codehaus.plexus:plexus-utils = 4.0.3 | \n
| \n | 7.5 | \norg.bouncycastle:bcpkix-jdk18on < 1.82 | \norg.bouncycastle:bcpkix-jdk18on = 1.84 | \n
| \n | 7.5 | \norg.apache.zookeeper:zookeeper < 3.8.4 | \norg.apache.zookeeper:zookeeper = 3.8.6 | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http2 < 4.1.130.Final | \nio.netty:netty-codec-http2 = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-handler-proxy < 4.1.130.Final | \nio.netty:netty-handler-proxy = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec < 4.1.130.Final | \nio.netty:netty-codec = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 7.5 | \nio.netty:netty-codec-mqtt < 4.1.130.Final | \nio.netty:netty-codec-mqtt = 4.1.133.Final | \n
| \n | 7.4 | \norg.apache.zookeeper:zookeeper < 3.8.4 | \norg.apache.zookeeper:zookeeper = 3.8.6 | \n
| \n | 7.4 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 2.15.0 | \n
| \n | 7.1 | \nio.netty:netty-codec-redis < 4.1.130.Final | \nio.netty:netty-codec-redis = 4.1.133.Final | \n
| \n | 6.9 | \ncom.fasterxml.jackson.core:jackson-core < 2.16.0 | \ncom.fasterxml.jackson.core:jackson-core = 2.18.6 | \n
| \n | 6.8 | \norg.asynchttpclient:async-http-client < 2.12.4 | \norg.asynchttpclient:async-http-client = 2.15.0 | \n
| \n | 6.5 | \norg.bouncycastle:bcprov-jdk18on < 1.82 | \norg.bouncycastle:bcprov-jdk18on = 1.84 | \n
| \n | 6.5 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 5.3 | \nio.netty:netty-codec-http < 4.1.130.Final | \nio.netty:netty-codec-http = 4.1.133.Final | \n
| \n | 5.3 | \nio.vertx:vertx-core < 4.5.24 | \nio.vertx:vertx-core = 4.5.27 | \n
| \n | 5.3 | \norg.apache.commons:commons-configuration2 < 2.11.0 | \norg.apache.commons:commons-configuration2 = 2.15.0 | \n
| \n | 5.3 | \nidna < 3.13 | \nidna = 3.18 | \n
This patch release uses Red Hat Universal Base Image 9 Minimal version 8.10-1780550539.
","user_segment_ids":[]}],"sort_by":"created_at","sort_order":"desc"}