Kafka on an End-of-Life Version: Upgrade, Patch or Migrate

This post is about the decision once a cluster is past end of life. For the dates of every release line, see the Kafka end-of-life chart.

Where Kafka support stands in October 2026

The Apache Kafka downloads page lists three supported releases: 4.3, 4.2 and 4.1. Everything older is archived, including 4.0 and every 3.x line. That covers 3.9, the last line that can run with ZooKeeper.

Counting what is left unpatched? Kafka vulnerabilities by version lists the CVEs that affect 2.8, 3.x and 4.x, and day-2 Kafka operations covers running the cluster once you choose.

Confluent Platform runs on its own calendar. Confluent Platform 7.8, built on Kafka 3.8, reaches the end of standard support on 2 December 2026, and 7.9, built on Kafka 3.9, on 19 February 2027.

The Kafka project does not publish formal EOL announcements the way PostgreSQL does, but the practical effect is the same: CVE fixes go to the supported lines only.

What Changed with KRaft (Kafka Without ZooKeeper)?

Kafka 3.3 introduced KRaft mode as generally available, replacing Apache ZooKeeper as the metadata management layer. Kafka 4.0 removed ZooKeeper mode entirely, so 3.9 is the last line that can run with ZooKeeper. This creates a double challenge for enterprises on Kafka 2.x and ZooKeeper-mode 3.x:

1. The version is EOL and unpatched
2. The migration path to a current version may require transitioning from ZooKeeper to KRaft, which is an operational change with its own testing requirements

OSSeva's Kafka extended lifecycle support covers Kafka 2.8 through 3.9 in both ZooKeeper and KRaft configurations.

Confluent Platform and Kafka EOL

Many enterprises running "Kafka" are actually running Confluent Platform, which adds Schema Registry, Control Center, tiered storage, and RBAC on top of the community Kafka core. Confluent Platform has its own version lifecycle that doesn't perfectly align with community Kafka versions.

Key point: if you are running Confluent Platform, your CVE exposure depends on both the underlying Kafka version and Confluent's own patching for their proprietary components.

OSSeva's Confluent exit program replaces Confluent Platform with OSSeva-supported community Kafka while keeping security coverage and compliance documentation in place.

The FedRAMP Problem with EOL Kafka

Government agencies and contractors operating Kafka within a FedRAMP boundary face a specific challenge: the System Security Plan (SSP) and Plan of Action & Milestones (POA&M) must document known vulnerabilities and remediation timelines. An EOL Kafka version with disclosed CVEs and no authorized patch source is a POA&M item that can threaten ATO maintenance if not resolved.

OSSeva's patched Kafka builds ship with CVE attestation documentation that can be attached to the POA&M as the remediation record.

JVM Considerations for Kafka on EOL Java

Kafka 2.x and early 3.x versions were typically deployed on Java 11, which itself reached Oracle end-of-premier-support in 2023. Enterprises running Kafka on Java 11 may have compounding EOL exposure: an EOL Kafka version on an EOL JVM. OSSeva coordinates Java and Kafka patch coverage for customers in this situation.

What To Do

For Kafka, the migration path depends on your architecture:

• Community Kafka 2.x or 3.x → Kafka 4.x: Move to KRaft on a 3.x bridge release first, then upgrade. OSSeva provides a migration playbook for this path with staged cutover guidance.
• Confluent Platform → OSSeva community Kafka: OSSeva's Confluent exit program handles Schema Registry migration, connector compatibility, and consumer group preservation.
• Extended lifecycle support during migration: OSSeva patches Kafka 2.8–3.9 with backported CVE fixes, providing compliance documentation and CVE attestations for the duration of your migration timeline.