Repository navigation
Kafka Connect: Multiple HIGH netty CVEs in transitive netty dependencies #16286
Description
Summary
The Kafka Connect runtime distribution bundles several io.netty jars at versions affected by six HIGH-severity CVEs (five distinct CVE IDs; CVE-2026-42587 affects two jars). All findings share the same root cause — netty is pulled in transitively, not declared directly by Iceberg — and are fixed by the same upstream release line. They are reported as a single issue because a single dependency bump (or constraint) will resolve all of them.
| CVE | Title | Affected jar (bundled version) | Fixed in |
|---|---|---|---|
| CVE-2026-42583 | Netty Lz4FrameDecoder resource exhaustion |
io.netty:netty-codec (4.1.132.Final) |
4.1.133.Final |
| CVE-2026-42579 | Netty DNS Codec Input Validation Bypass (encoder + decoder) | io.netty:netty-codec-dns (4.1.128.Final) |
4.1.133.Final, 4.2.13.Final |
| CVE-2026-42584 | Netty HttpClientCodec response desynchronization |
io.netty:netty-codec-http (4.1.132.Final) |
4.1.133.Final, 4.2.13.Final |
| CVE-2026-42587 | Netty HttpContentDecompressor maxAllocation bypass (br/zstd/snappy decompression-bomb DoS) |
io.netty:netty-codec-http (4.1.132.Final) |
4.1.133.Final, 4.2.13.Final |
| CVE-2026-42587 | (as above) | io.netty:netty-codec-http2 (4.1.132.Final) |
4.1.133.Final, 4.2.13.Final |
| CVE-2026-42577 | Netty epoll transport DoS via RST on half-closed TCP connection | io.netty:netty-transport-native-epoll (4.1.130.Final) |
4.2.13.Final |
Netty 4.1.133.Final and 4.2.13.Final were both released on 2026-05-04 and are available on Maven Central.
Reproducing
Build the Kafka Connect runtime distribution and scan with Trivy:
# Build from main
./gradlew :iceberg-kafka-connect:iceberg-kafka-connect-runtime:distZip -x test -x integrationTest
# Unzip the distribution
unzip -q kafka-connect/kafka-connect-runtime/build/distributions/iceberg-kafka-connect-runtime-*.zip -d /tmp/iceberg-kc-scan
# Scan with Trivy (use rootfs mode for standalone JAR detection)
trivy rootfs /tmp/iceberg-kc-scan/iceberg-kafka-connect-runtime-*/lib/ -s HIGH,CRITICAL --scanners vulnThese findings are also reported by the Kafka Connect CVE Scan workflow added in #15430; see, for example, this run.
Note
This analysis was performed with the assistance of Claude Opus 4.7 (Anthropic).
Activity
kevinjqliu commentedon May 11, 2026
thanks @rmoff i opened #16290 to address these CVEs for kafka-connect and other bundles, we should include it in the upcoming 1.11.0 release