Control Center Next Generation v2.5.1
Control Center Next Generation patch release 2.5.1 addresses security hygiene improvements across Control Center Next Generation components through upgrades to third-party dependencies.
Security Vulnerabilities
Control Center Next Generation 2.5.1 did not include any upgrades related to exploitable security vulnerabilities.
Resolved hygiene issues in 3rd party dependencies
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE |
CVSS |
Impacted Package Version |
Upgraded Package Version |
9.1 |
google.golang.org/grpc < 1.79.3 |
google.golang.org/grpc = 1.80.0, 1.81.1 |
|
8.8 |
org.codehaus.plexus:plexus-utils < 4.0.3, 3.6.1 |
org.codehaus.plexus:plexus-utils = 4.0.3 |
|
8.8 |
github.com/docker/docker < 29.3.1 |
github.com/docker/docker = Removed |
|
8.2 |
stdlib < 1.26.2 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
org.eclipse.jetty:jetty-server < 12.1.6, 12.0.32 |
org.eclipse.jetty:jetty-server = 12.0.35 |
|
7.5 |
stdlib < 1.25.8, 1.26.1 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
stdlib < 1.26.1 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
go.opentelemetry.io/otel < 1.41.0 |
go.opentelemetry.io/otel = 1.41.0, 1.44.0 |
|
7.5 |
stdlib < 1.25.9, 1.26.2 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
stdlib < 1.25.9, 1.26.2 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
stdlib < 1.25.9, 1.26.2 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
github.com/buger/jsonparser < 1.1.2 |
github.com/buger/jsonparser = 1.1.2 |
|
7.5 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
io.netty:netty-codec-http < 4.1.132.Final, 4.2.10.Final |
io.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final |
|
7.5 |
io.netty:netty-codec-http2 < 4.1.132.Final, 4.2.11.Final |
io.netty:netty-codec-http2 = 4.1.133.Final, 4.2.13.Final |
|
7.5 |
org.apache.logging.log4j:log4j-core < 2.25.4 |
org.apache.logging.log4j:log4j-core = 2.25.4 |
|
7.5 |
org.apache.logging.log4j:log4j-core < 2.25.4 |
org.apache.logging.log4j:log4j-core = 2.25.4 |
|
7.5 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
7.5 |
io.netty:netty-handler-proxy < 4.1.133.Final, 4.2.13.Final |
io.netty:netty-handler-proxy = 4.1.133.Final, 4.2.13.Final |
|
7.5 |
io.netty:netty-codec-dns < 4.2.13.Final, 4.1.133.Final |
io.netty:netty-codec-dns = 4.1.133.Final, 4.2.13.Final |
|
7.5 |
io.netty:netty-codec < 4.1.133.Final |
io.netty:netty-codec = 4.1.133.Final, 4.2.13.Final |
|
7.5 |
io.netty:netty-codec-http2 < 4.2.13.Final, 4.1.133.Final |
io.netty:netty-codec-http2 = 4.1.133.Final, 4.2.13.Final |
|
7.5 |
io.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final |
io.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final |
|
7.4 |
org.eclipse.jetty:jetty-http < 12.1.7, 12.0.33 |
org.eclipse.jetty:jetty-http = 12.0.35 |
|
7.4 |
org.asynchttpclient:async-http-client < 3.0.10, 2.15.0 |
org.asynchttpclient:async-http-client = 3.0.10 |
|
7.3 |
io.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final |
io.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final |
|
7.2 |
github.com/docker/docker = 28.5.2+incompatible |
github.com/docker/docker = Removed |
|
7.2 |
github.com/docker/docker = 28.5.2+incompatible |
github.com/docker/docker = Removed |
|
7.0 |
go.opentelemetry.io/otel/sdk < 1.40.0 |
go.opentelemetry.io/otel/sdk = 1.41.0, 1.44.0 |
|
6.9 |
com.fasterxml.jackson.core:jackson-core < 2.21.1, 2.18.6 |
com.fasterxml.jackson.core:jackson-core = 2.21.2 |
|
6.8 |
github.com/docker/docker < 29.3.1 |
github.com/docker/docker = Removed |
|
6.8 |
org.asynchttpclient:async-http-client < 3.0.9, 2.14.5 |
org.asynchttpclient:async-http-client = 3.0.10 |
|
6.5 |
go.mongodb.org/mongo-driver < 1.17.7 |
go.mongodb.org/mongo-driver = Removed |
|
6.5 |
io.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final |
io.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final |
|
6.5 |
io.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final |
io.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final |
|
6.4 |
stdlib < 1.25.9, 1.26.2 |
stdlib = 1.26.3, 1.26.4 |
|
6.1 |
stdlib < 1.25.8, 1.26.1 |
stdlib = 1.26.3, 1.26.4 |
|
6.1 |
stdlib < 1.25.9, 1.26.2 |
stdlib = 1.26.3, 1.26.4 |
|
6.1 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
6.1 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
6.1 |
github.com/prometheus/prometheus < 0.311.2-0.20260410083055-07c6232d159b |
github.com/prometheus/prometheus = 3.12.0 |
|
6.0 |
github.com/docker/docker = 28.5.2+incompatible |
github.com/docker/docker = Removed |
|
5.9 |
stdlib < 1.26.1 |
stdlib = 1.26.3, 1.26.4 |
|
5.9 |
org.apache.logging.log4j:log4j-core < 2.25.4 |
org.apache.logging.log4j:log4j-core = 2.25.4 |
|
5.8 |
io.netty:netty-codec-http < 4.2.13.Final, 4.1.133.Final |
io.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final |
|
5.5 |
stdlib < 1.25.9, 1.26.2 |
stdlib = 1.26.3, 1.26.4 |
|
5.3 |
stdlib < 1.25.10, 1.26.3 |
stdlib = 1.26.3, 1.26.4 |
|
5.3 |
io.netty:netty-codec-http < 4.1.133.Final, 4.2.13.Final |
io.netty:netty-codec-http = 4.1.133.Final, 4.2.13.Final |
|
3.7 |
org.eclipse.jetty:jetty-http < 12.0.31, 12.1.5 |
org.eclipse.jetty:jetty-http = 12.0.35 |
|
2.5 |
stdlib < 1.25.8, 1.26.1 |
stdlib = 1.26.3, 1.26.4 |
This patch release uses Red Hat Universal Base Image 9 Minimal version 9.8-1780378819.