Skip to main content

Security Release Notes for CP 7.8.12

  • Updated

Confluent Platform patch release version 7.8.12 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components. 

Security Vulnerabilities

Confluent Platform 7.8.12 patch release contains fix for the following security vulnerability:

Vulnerability 

Reference

CVSS

Affected Components

Resolution

CONFSA-2026-33 / CVE-2026-114820, CVE-2026-114406

6.6

Confluent Platform

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-26 / CVE-2026-111115

6.5

Kafka Broker

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-35 / CVE-2026-12611

 6.5

Jetty

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-31 / CVE-2026-110952

6.4

Kafka Broker

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-34 / CVE-2026-111497:

6.4

brotli4j

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-25 / CVE-2026-111108:

5.7

Kafka Broker

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-28 / CVE-2026-83525

5.7

Kafka KRaft

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-29: CVE-2026-111496:

5.7

Kafka Streams

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-30 / CVE-2026-112375 

5.7

Kafka Broker

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-32

5.7

Kafka Broker

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-27 / CVE-2026-115644

3.1

Kafka Connect

This issue has been fixed in Confluent Platform version 7.8.12.

CONFSA-2026-36 / CVE-2026-59739

4.3

Zookeeper

This issue has been fixed in Confluent Platform version 7.8.12.

More information in the following Confluent Security Advisories:

  • CONFSA-2026-33 / CVE-2026-114820, CVE-2026-114406 - Confluent Platform:  Compromised eMudhra Certificate Authority Roots and intermediates.
  • CONFSA-2026-35 / CVE-2026-12611: Confluent Cloud and Confluent Platform: Denial of Service (DoS) due to improper handling of data by Jetty HTTP2 server 
  • CONFSA-2026-26 CVE-2026-111115: Confluent Cloud and Confluent Platform: Denial of Service (DoS) in Kafka Brokers via unbounded tagged-field(s)
  • CONFSA-2026-31 / CVE-2026-110952: Confluent Platform: Implementation flaw in JWT validation logic
  • CONFSA-2026-34 / CVE-2026-111497: Confluent Platform: Buffer overflow vulnerability in the third party dependency [brotli4j]
  • CONFSA-2026-32: Confluent Platform and Confluent Cloud: Denial of Service (DoS) in Kafka Broker and Kafka Clients via malformed Snappy Compressed Data
  • CONFSA-2026-25 CVE-2026-111108: Confluent Cloud and Confluent Platform: Denial of Service (DoS) in Kafka Brokers via Protocol Array Pre-Allocation Amplification
  • CONFSA-2026-28 / CVE-2026-83525: Confluent Platform: Denial of  Service (DoS) in KRaft Controller via malformed request processing.
  • CONFSA-2026-29 / CVE-2026-111496: Confluent Platform: Denial of Service (DoS) in Kafka Streams due to Integer Overflow vulnerability
  • CONFSA-2026-30  CVE-2026-112375: Confluent Cloud and Confluent Platform: Arbitrary File Read in Kafka Broker
  • CONFSA-2026-27  CVE-2026-115644: Confluent Platform: Missing Access Control Unauthenticated Access to Kafka Connect Logging API
  • CONFSA-2026-36 / CVE-2026-59739: Confluent Platform Vulnerability: Missing Access Control Checks in Apache ZooKeeper

Resolved hygiene issues in 3rd party dependencies

The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis. 

CVE

CVSS

Impacted Package Version

Upgraded Package Version

CVE-2026-75595

9.1

io.netty:netty-handler < 4.1.137.Final

io.netty:netty-handler = 4.1.139.Final

CVE-2026-8763

9.1

org.bouncycastle:bc-fips < 2.1.3

org.bouncycastle:bc-fips = 2.1.3

CVE-2026-8798

8.7

org.bouncycastle:bc-fips < 2.1.3

org.bouncycastle:bc-fips = 2.1.3

CVE-2026-93569

8.2

io.netty:netty-codec-http2 < 4.1.138.Final

io.netty:netty-codec-http2 = 4.1.139.Final

CVE-2026-18661

8.2

org.eclipse.jetty:jetty-annotations < 9.4.65

org.eclipse.jetty:jetty-annotations = 9.4.65

CVE-2026-18660

8.2

org.eclipse.jetty:jetty-proxy < 9.4.65

org.eclipse.jetty:jetty-proxy = 9.4.65

CVE-2026-89407

7.5

com.fasterxml.jackson.core:jackson-core < 2.18.11

com.fasterxml.jackson.core:jackson-core = 2.18.11

CVE-2026-89425

7.5

com.fasterxml.jackson.core:jackson-core < 2.18.11

com.fasterxml.jackson.core:jackson-core = 2.18.11

CVE-2026-68497

7.5

com.fasterxml.jackson.core:jackson-databind < 2.18.10

com.fasterxml.jackson.core:jackson-databind = 2.18.11

CVE-2026-91776

7.5

com.fasterxml.jackson.core:jackson-databind < 2.18.11

com.fasterxml.jackson.core:jackson-databind = 2.18.11

CVE-2026-91777

7.5

com.fasterxml.jackson.core:jackson-databind < 2.18.11

com.fasterxml.jackson.core:jackson-databind = 2.18.11

CVE-2026-40984

7.5

io.micrometer:micrometer-core < 1.15.12

io.micrometer:micrometer-core = 1.15.12

CVE-2026-93567

7.5

io.netty:netty-codec-http2 < 4.1.138.Final

io.netty:netty-codec-http2 = 4.1.139.Final

CVE-2026-93568

7.5

io.netty:netty-codec-http2 < 4.1.138.Final

io.netty:netty-codec-http2 = 4.1.139.Final

CVE-2026-93575

7.5

io.netty:netty-codec-mqtt < 4.1.138.Final

io.netty:netty-codec-mqtt = 4.1.139.Final

CVE-2026-93572

7.5

io.netty:netty-codec-redis < 4.1.138.Final

io.netty:netty-codec-redis = 4.1.139.Final

CVE-2026-93563

7.5

io.netty:netty-codec-smtp < 4.1.138.Final

io.netty:netty-codec-smtp = 4.1.139.Final

GHSA-cc6x-ffm5-83wf

7.5

io.netty:netty-codec-socks < 4.1.137.Final

io.netty:netty-codec-socks = 4.1.139.Final

CVE-2026-93494

7.5

io.netty:netty-codec-stomp < 4.1.138.Final

io.netty:netty-codec-stomp = 4.1.139.Final

CVE-2026-75596

7.5

io.netty:netty-handler < 4.1.137.Final

io.netty:netty-handler = 4.1.139.Final

GHSA-p85m-gvr3-788c

7.5

io.netty:netty-handler < 4.1.137.Final

io.netty:netty-handler = 4.1.139.Final

CVE-2026-107231

7.5

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-85721

7.5

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-13505

7.5

org.bouncycastle:bc-fips < 2.1.3

org.bouncycastle:bc-fips = 2.1.3

CVE-2026-13506

7.5

org.bouncycastle:bc-fips < 2.1.3

org.bouncycastle:bc-fips = 2.1.3

CVE-2026-77422

7.5

org.jline:jline-builtins < 3.30.15

org.jline:jline-builtins = 3.30.17

CVE-2026-56740

7.5

org.jline:jline-remote-telnet < 3.30.14

org.jline:jline-remote-telnet = 3.30.17

CVE-2026-56741

7.5

org.jline:jline-remote-telnet < 3.30.14

org.jline:jline-remote-telnet = 3.30.17

CVE-2026-108106

7.5

org.xerial.snappy:snappy-java < 1.1.10.9

org.xerial.snappy:snappy-java = 1.1.10.11

CVE-2026-93451

7.5

org.xerial.snappy:snappy-java < 1.1.10.9

org.xerial.snappy:snappy-java = 1.1.10.11

CVE-2026-93578

7.4

io.netty:netty-handler-ssl-ocsp < 4.1.138.Final

io.netty:netty-handler-ssl-ocsp = 4.1.139.Final

GHSA-2g6j-r8q9-5hr8

7.3

io.netty:netty-codec-http < 4.1.137.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-106451

7.0

at.yawk.lz4:lz4-java < 1.11.4

at.yawk.lz4:lz4-java = 1.11.4

CVE-2026-85717

6.8

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-59903

6.5

io.netty:netty-codec-http < 4.1.137.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-89044

6.5

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-93566

6.5

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-93573

6.5

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-93574

6.5

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-107282

6.5

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-18659

6.5

org.eclipse.jetty:jetty-security < 9.4.65

org.eclipse.jetty:jetty-security = 9.4.65

CVE-2026-18662

6.5

org.eclipse.jetty:jetty-security < 9.4.65

org.eclipse.jetty:jetty-security = 9.4.65

CVE-2026-77421

6.5

org.jline:jline-builtins < 3.30.15

org.jline:jline-builtins = 3.30.17

CVE-2026-93493

5.9

io.netty:netty-handler-ssl-ocsp < 4.1.138.Final

io.netty:netty-handler-ssl-ocsp = 4.1.139.Final

CVE-2026-107285

5.9

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-85720

5.9

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-116590

5.9

org.xerial.snappy:snappy-java < 1.1.10.9

org.xerial.snappy:snappy-java = 1.1.10.11

CVE-2026-83557

5.6

com.fasterxml.jackson.core:jackson-databind < 2.18.10

com.fasterxml.jackson.core:jackson-databind = 2.18.11

CVE-2026-77420

5.5

org.jline:jline-reader < 3.30.15

org.jline:jline-reader = 3.30.17

CVE-2026-106450

5.3

at.yawk.lz4:lz4-java < 1.11.4

at.yawk.lz4:lz4-java = 1.11.4

CVE-2026-106452

5.3

at.yawk.lz4:lz4-java < 1.11.2

at.yawk.lz4:lz4-java = 1.11.4

CVE-2026-106453

5.3

at.yawk.lz4:lz4-java < 1.11.2

at.yawk.lz4:lz4-java = 1.11.4

CVE-2026-19032

5.3

com.fasterxml.jackson.core:jackson-databind < 2.18.10

com.fasterxml.jackson.core:jackson-databind = 2.18.11

CVE-2026-93564

5.3

io.netty:netty-codec-haproxy < 4.1.138.Final

io.netty:netty-codec-haproxy = 4.1.139.Final

GHSA-2g37-3h88-55hc

5.3

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-93492

5.3

io.netty:netty-codec-http2 < 4.1.138.Final

io.netty:netty-codec-http2 = 4.1.139.Final

CVE-2026-45292

5.3

io.opentelemetry:opentelemetry-api < 1.62.0

io.opentelemetry:opentelemetry-api = 1.62.0

io.opentelemetry:opentelemetry-api = 1.65.0

CVE-2026-107280

5.3

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-55688

4.0

org.asynchttpclient:async-http-client < 2.16.0

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-106449

3.7

at.yawk.lz4:lz4-java < 1.11.4

at.yawk.lz4:lz4-java = 1.11.4

CVE-2026-107283

3.7

org.asynchttpclient:async-http-client < 2.16.1

org.asynchttpclient:async-http-client = 2.16.1

CVE-2026-93565

n/a

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

GHSA-pvjx-v7vp-62vq

n/a

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

GHSA-rmcw-9fcq-wjq7

n/a

io.netty:netty-codec-http < 4.1.138.Final

io.netty:netty-codec-http = 4.1.139.Final

CVE-2026-93579

n/a

io.netty:netty-codec-http2 < 4.1.138.Final

io.netty:netty-codec-http2 = 4.1.139.Final

CVE-2026-93561

n/a

io.netty:netty-codec-memcache < 4.1.138.Final

io.netty:netty-codec-memcache = 4.1.139.Final

CVE-2026-93576

n/a

io.netty:netty-codec-smtp < 4.1.138.Final

io.netty:netty-codec-smtp = 4.1.139.Final

CVE-2026-93560

n/a

io.netty:netty-codec-stomp < 4.1.138.Final

io.netty:netty-codec-stomp = 4.1.139.Final

CVE-2026-12611

n/a

org.eclipse.jetty.http2:http2-common < 9.4.64

org.eclipse.jetty.http2:http2-common = 9.4.65

CVE-2026-76184

n/a

org.eclipse.jetty:jetty-client < 9.4.65

org.eclipse.jetty:jetty-client = 9.4.65

CVE-2026-77711

n/a

org.eclipse.jetty:jetty-client < 9.4.65

org.eclipse.jetty:jetty-client = 9.4.65

CVE-2026-19203

n/a

org.eclipse.jetty:jetty-http < 9.4.64

org.eclipse.jetty:jetty-http = 9.4.65

CVE-2026-19864

n/a

org.eclipse.jetty:jetty-security < 9.4.65

org.eclipse.jetty:jetty-security = 9.4.65

This patch release uses Red Hat Universal Base Image 8 Minimal version 8.10-1793307920.

Was this article helpful?
0 out of 0 found this helpful
Return to top

Related articles