# How to handle Confluent CVEs?

**URL:** <https://forum.confluent.io/t/how-to-handle-confluent-cves/2949>\
**Category:** Ops\
**Created:** [30 September 2021 20:25 UTC](https://forum.confluent.io/t/how-to-handle-confluent-cves/2949 "2021-09-30T20:25:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![IcyRoad](https://avatars.discourse-cdn.com/v4/letter/i/5daacb/32.png) [@IcyRoad](https://forum.confluent.io/u/IcyRoad)\
**Post date:** [30 September 2021 20:25 UTC](https://forum.confluent.io/t/how-to-handle-confluent-cves/2949/1 "2021-09-30T20:25:17Z")

</div>

Hey folks,  
Can you please share your suggestions and ideas about how to address Confluent Kafka CVEs on each version?  
Do I need to take any action on them?

Thanks,  
Liz.

---

<div class="post-metadata">

**Author:** ![gklijs](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/gklijs/32/223_2.png) [@gklijs](https://forum.confluent.io/u/gklijs)\
**Post date:** [1 October 2021 05:16 UTC](https://forum.confluent.io/t/how-to-handle-confluent-cves/2949/2 "2021-10-01T05:16:27Z")

</div>

Do you mean [NVD - CVE-2021-38153](https://nvd.nist.gov/vuln/detail/CVE-2021-38153)? You can upgrade to 2.8.1 or 3.0.0.  
If you are using Spring, and specifically the related Kafka-test, you have to wait a bit for the next release. See [Releases · spring-projects/spring-kafka · GitHub](https://github.com/spring-projects/spring-kafka/releases) (main branch is already updated to 2.8.1).

---

<div class="post-metadata">

**Author:** ![IcyRoad](https://avatars.discourse-cdn.com/v4/letter/i/5daacb/32.png) [@IcyRoad](https://forum.confluent.io/u/IcyRoad)\
**Post date:** [5 October 2021 18:44 UTC](https://forum.confluent.io/t/how-to-handle-confluent-cves/2949/3 "2021-10-05T18:44:26Z")

</div>

Sorry for the delayed response.  
I am asking in general, usually when Confluent publish the CVE’s list for each version, we should wait until next release or upgrade to next release. But due to the constraints that we have, we cannot immediately proceed to next upgrade. So how to handle this situation.

Thx,  
Liz.

---

<div class="post-metadata">

**Author:** ![rmoff](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/rmoff/32/3_2.png) [@rmoff](https://forum.confluent.io/u/rmoff)\
**Post date:** [5 October 2021 18:50 UTC](https://forum.confluent.io/t/how-to-handle-confluent-cves/2949/4 "2021-10-05T18:50:00Z")

</div>

Are you already a Confluent customer? This is something that you could raise a support ticket to discuss directly.

---

<div class="post-metadata">

**Author:** ![IcyRoad](https://avatars.discourse-cdn.com/v4/letter/i/5daacb/32.png) [@IcyRoad](https://forum.confluent.io/u/IcyRoad)\
**Post date:** [5 October 2021 19:06 UTC](https://forum.confluent.io/t/how-to-handle-confluent-cves/2949/5 "2021-10-05T19:06:44Z")

</div>

yes we do.  
Let me check with them.

Thank you.