Apache Kafka 3.8 end of life
Apache Kafka 3.8 reached end of life on 6 November 2024, when Kafka 3.9 was released. The Apache Kafka project maintains only the most recent releases, so each minor version's support window closes as the next ships. The final release on the line was 3.8.1.
What now
Which vendors provide Apache Kafka 3.8 security patches now that support has ended?
Kafka End of Life Support: 3.x on ZooKeeper, then KRaft- End of life
- 6 November 2024
- Released
- Jul 2024
- Final release
- 3.8.1
- Successor
- Kafka 3.9 (final 3.x) or 4.x
Date published by Apache Kafka downloads and release policy. We do not publish a lifecycle date we cannot source. Dates checked on kafka.apache.org and endoflife.date on 20 October 2026, which agree on 3.8.
Last reviewed
Apache Kafka versions: release and end-of-life dates
| Version | Released | End of life | Status |
|---|---|---|---|
| Apache Kafka 3.9 | 6 Nov 2024 | 21 February 2026 (final release; line archived) | End of life |
| Apache Kafka 3.8 (this page) | 29 Jul 2024 | 6 November 2024 | End of life |
| Apache Kafka 2.8 | 19 Apr 2021 | 19 September 2022 (final release, 2.8.2) | End of life |
End-of-life dates are published by each project and checked against endoflife.date.
What actually stops on 6 November 2024
- Bug-fix and security releases on the 3.8.x line.
- Apache security advisories referencing 3.8 as a supported target.
- Nothing operational. Brokers keep serving; what stops is the fix supply.
What actually breaks in the upgrade
ZooKeeper is removed in 4.0, and 3.9 is the migration bridge
Kafka 4.0 runs only in KRaft mode. Kafka 3.9 is the designated bridge release that supports migrating a ZooKeeper-based cluster to KRaft. A cluster still on ZooKeeper must pass through 3.9 to migrate; it cannot jump to 4.x. This makes 3.9 the single most important version in any Kafka upgrade plan right now.
The ZooKeeper to KRaft migration is a one-way door
Once a cluster completes the migration to KRaft, there is no supported rollback to ZooKeeper. That makes rehearsal on a representative cluster non-optional, and it is the main reason the migration gets deferred.
Client compatibility is usually fine; the tooling is not
Kafka's protocol compatibility means clients generally keep working across broker upgrades. What breaks is operational tooling that talks to ZooKeeper directly — monitoring, admin scripts and older third-party consoles. Inventory those before the migration, not after.
CVEs published since Kafka 3.8 ended
These are the CVEs in OSSeva's CVE directory that name Kafka 3.8 and were published after 6 November 2024. Apache fixed each first in 3.9.1 or 3.9.2, so no 3.8 release carries a fix.
3 in the directory as of 20 October 2026.
| CVE | CVSS | Published | Issue | Fixed upstream in |
|---|---|---|---|---|
| CVE-2025-27818 | 8.8 | 10 Jun 2025 | possible security vulnerability has been identified in Apache Kafka. | 3.9.1 and later |
| CVE-2025-27817 | 7.5 | 10 Jun 2025 | possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. | 3.9.1 and later |
| CVE-2026-35554 | 8.7 | 7 Apr 2026 | race condition in the Apache Kafka Java producer client’s buffer pool management can cause… | 3.9.2, 4.0.2, 4.1.2 and later |
The directory lists Kafka CVEs matched at NVD to the product. A CVE is listed when its MITRE record names a range that covers the line and it was published after the line ended. Fixed-in versions are from the MITRE records.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to 3.9 then migrate to KRaft | The supported route off ZooKeeper and onto 4.x. | Scales with cluster count, clients and rehearsal | Engineering time | The right answer, and 3.9 is the mandatory bridge. Rehearse: the migration does not roll back. |
| Extended support on 3.8 | Backported CVE fixes on the 3.8 line while the KRaft migration is planned: Critical 48 hours, High 7 days. | Starts from your current version | Subscription, priced per cluster | Reasonable for a regulated estate that needs cover during a migration it cannot rush. |
| Confluent Platform | Commercial Kafka distribution with a longer support window. | Procurement and migration | Platform pricing | Buys a support window and a platform you then depend on. Worth comparing against patching the Apache distribution you already run. |
| Stay unpatched | No upstream fixes since November 2024. | None | Zero now | Kafka's exposure depends heavily on whether the cluster is reachable beyond its own network. Assess honestly before accepting. |
What OSSeva does for Apache Kafka 3.8
OSSeva patches this line
OSSeva backports CVE fixes to Apache Kafka 3.8 and ships signed builds through your repository manager. We support the Apache distribution, not a fork: a patched 3.8 stays wire-compatible with the 3.8 your clients expect. Where the honest answer is to move to 3.9 and migrate to KRaft, we will say so.
Apache Kafka extended supportWhat your auditor will say
Requirement 6.3.3, wherever the cluster carries or touches cardholder data.
CC7.1, plus availability criteria for a component that is usually load-bearing.
For EU financial entities, an unsupported streaming platform underneath critical services engages ICT risk-management obligations directly.
When did Apache Kafka 3.8 reach end of life?
6 November 2024, when Kafka 3.9 was released. Apache Kafka maintains only its most recent releases, so each minor version's window closes as the next ships. The final release was 3.8.1.
Is Apache Kafka 3.8 still supported?
Not by the Apache project. Third-party extended support and commercial distributions are the remaining options.
Do I need Kafka 3.9 to get to Kafka 4?
If you are still on ZooKeeper, yes. Kafka 4.0 runs only in KRaft mode, and 3.9 is the designated bridge release that supports migrating a ZooKeeper cluster to KRaft. You cannot jump straight to 4.x.
Can you roll back a KRaft migration?
No. Once a cluster completes the migration from ZooKeeper to KRaft there is no supported path back, which is why rehearsing on a representative cluster matters more here than in a normal version upgrade.
Can I get security patches for Kafka 3.8?
Yes, from a third-party provider. OSSeva backports CVE fixes to the 3.8 line and ships signed builds of the Apache distribution, not a fork.
What breaks in a Kafka broker upgrade?
Rarely clients, because Kafka's protocol compatibility is strong. What breaks is operational tooling that talks to ZooKeeper directly: monitoring agents, admin scripts and older third-party consoles.
Get a quote
Still running Apache Kafka 3.8?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?