Confluent Platform patch release version 8.4.1 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Security Vulnerabilities
Confluent Platform 8.4.1 patch release contains fix for the following security vulnerability:
|
Vulnerability Reference |
CVSS |
Affected Components |
Resolution |
CONFSA-2026-33 / CVE-2026-114820, CVE-2026-114406 |
6.6 |
Confluent Platform |
This issue has been fixed in Confluent Platform version 8.4.1. |
CONFSA-2026-35 / CVE-2026-12611 |
6.5 |
Jetty |
This issue has been fixed in Confluent Platform version 8.4.1. |
CONFSA-2026-32 |
5.7 |
Kafka Broker |
This issue has been fixed in Confluent Platform version 8.4.1. |
More information in the following Confluent Security Advisories:
- CONFSA-2026-33 / CVE-2026-114820, CVE-2026-114406 - Confluent Platform: Compromised eMudhra Certificate Authority Roots and intermediates.
- CONFSA-2026-35 / CVE-2026-12611: Confluent Cloud and Confluent Platform: Denial of Service (DoS) due to improper handling of data by Jetty HTTP2 server
- CONFSA-2026-32: Confluent Platform and Confluent Cloud: Denial of Service (DoS) in Kafka Broker and Kafka Clients via malformed Snappy Compressed Data
Resolved hygiene issues in 3rd party dependencies
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifiers to assist customers with analysis.
CVE |
CVSS |
Impacted Package Version |
Upgraded Package Version |
8.2 |
io.netty:netty-codec-http2 < 4.1.138.Final io.netty:netty-codec-http2 < 4.2.18.Final |
io.netty:netty-codec-http2 = 4.1.139.Final io.netty:netty-codec-http2 = 4.2.19.Final |
|
7.5 |
io.netty:netty-codec-http2 < 4.1.138.Final io.netty:netty-codec-http2 < 4.2.18.Final |
io.netty:netty-codec-http2 = 4.1.139.Final io.netty:netty-codec-http2 = 4.2.19.Final |
|
7.5 |
io.netty:netty-codec-http2 < 4.1.138.Final io.netty:netty-codec-http2 < 4.2.18.Final |
io.netty:netty-codec-http2 = 4.1.139.Final io.netty:netty-codec-http2 = 4.2.19.Final |
|
7.5 |
org.jline:jline-builtins < 3.30.15 |
org.jline:jline-builtins = 3.30.17 |
|
7.5 |
org.xerial.snappy:snappy-java < 1.1.10.9 |
org.xerial.snappy:snappy-java = 1.1.10.11 org.xerial.snappy:snappy-java = 1.1.10.12 |
|
7.5 |
org.xerial.snappy:snappy-java < 1.1.10.9 |
org.xerial.snappy:snappy-java = 1.1.10.11 org.xerial.snappy:snappy-java = 1.1.10.12 |
|
7.0 |
at.yawk.lz4:lz4-java < 1.11.4 |
at.yawk.lz4:lz4-java = 1.11.4 |
|
6.5 |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
6.5 |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
6.5 |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
6.5 |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
6.5 |
org.jline:jline-builtins < 3.30.15 |
org.jline:jline-builtins = 3.30.17 |
|
5.9 |
org.xerial.snappy:snappy-java < 1.1.10.9 |
org.xerial.snappy:snappy-java = 1.1.10.11 org.xerial.snappy:snappy-java = 1.1.10.12 |
|
5.5 |
org.jline:jline-reader < 3.30.15 |
org.jline:jline-reader = 3.30.17 |
|
5.3 |
at.yawk.lz4:lz4-java < 1.11.4 |
at.yawk.lz4:lz4-java = 1.11.4 |
|
5.3 |
io.netty:netty-codec-haproxy < 4.1.138.Final |
io.netty:netty-codec-haproxy = 4.1.139.Final |
|
5.3 |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
5.3 |
io.netty:netty-codec-http2 < 4.1.138.Final io.netty:netty-codec-http2 < 4.2.18.Final |
io.netty:netty-codec-http2 = 4.1.139.Final io.netty:netty-codec-http2 = 4.2.19.Final |
|
3.7 |
at.yawk.lz4:lz4-java < 1.11.4 |
at.yawk.lz4:lz4-java = 1.11.4 |
|
n/a |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
n/a |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
n/a |
io.netty:netty-codec-http < 4.1.138.Final io.netty:netty-codec-http < 4.2.18.Final |
io.netty:netty-codec-http = 4.1.139.Final io.netty:netty-codec-http = 4.2.19.Final |
|
n/a |
io.netty:netty-codec-http2 < 4.1.138.Final io.netty:netty-codec-http2 < 4.2.18.Final |
io.netty:netty-codec-http2 = 4.1.139.Final io.netty:netty-codec-http2 = 4.2.19.Final |
This patch release uses Red Hat Universal Base Image 9 Micro version 9.8-1791895366.