> Similar to the previous issue, it took almost six months for developers to implement a fix in version 0.7.2 of Kafka UI. They fixed it by only updating the Ap

> Similar to the previous issue, it took almost six months for developers to implement a fix in version 0.7.2 of Kafka UI. They fixed it by only updating the Apache Commons Collections library to the newer version. While it prevents the second stage of the gadget chain I shared above, the deserialization of untrusted data still can occur. This is concerning, that it took that long for it to be addressed.. also, the changelog involving these issues doesn't exactly inspire confidence because it has fixing the issues marked as a 'chore'[0] - this could cause people to skip the update if they skim it and see the only change was a 'chore' change. [0]: https://github.com/provectus/kafka-ui/releases/tag/v0.7.2 https://github.com/provectus/kafka-ui/releases/tag/v0.7.2 Edit: After taking a closer look, the long timeline for the fix makes a little bit more sense - Provectus, the company behind kafka-ui, made a point late last year that they are pausing or otherwise stepping back from active development of the project[1]. I still think that 6 months is a bit of a long time, but with the additional context it seems less like security neglience and more just the project not being anyones' focus. [1]: https://github.com/provectus/kafka-ui/discussions/4255 https://github.com/provectus/kafka-ui/discussions/4255