Redpanda Release Notes

The internal HTTP client no longer performs an out-of-bounds read when decoding a URI that ends with a truncated percent-escape.

The write-request scheduler no longer consumes a full CPU core on shards whose backlog cannot be uploaded.

Iceberg producer throttling now uses max_kafka_throttle_delay_ms as the throttle ceiling and quota_manager_gc_sec as the producer GC window. These two settings were previously flipped at the point of use.

A broker connection in the internal Kafka client (used by Schema Registry, HTTP Proxy, and Shadow Link) no longer gets stuck unable to complete API version negotiation. Previously such a connection could fail repeatedly with broker_not_available until the socket dropped for an unrelated reason.

A response that arrives after its request has already timed out no longer desyncs the internal Kafka client connection’s protocol framing. Previously this could cause cascading disconnects and stalled requests on that connection.

The Kafka quota manager no longer triggers a use-after-free during shutdown in its garbage collection.

JSON Schema compatibility checks now handle schemas that use fragment-only or fragment-bearing $id values. Previously these checks could resolve $ref values against the wrong subschema. Compatibility verdicts for affected schemas may change.

JSON Schema compatibility checks no longer crash on schemas whose $ref targets a boolean or a non-schema value.

A JSON Schema compatibility check no longer aborts the broker when a required property has a boolean subschema.

Produce requests are now rejected if any schema-ID-validated key or value in a batch is invalid. Previously a batch could be accepted when only its last validated component was valid, which persisted invalid records.

Describing or deleting ACLs on clusters with many distinct ACL resource patterns no longer causes oversized memory allocations.

OpenSSL is upgraded to 3.5.8, which addresses reported security vulnerabilities.

c-ares is upgraded to 1.34.8, which addresses CVE-2026-33630.

Records are no longer silently dropped from compacted topics after a partly successful log append.

Metadata spillover no longer gets permanently stuck on partitions with small, frequent segments. Previously it could repeatedly log Can’t apply spillover_cmd and leave orphaned spillover manifest objects in the bucket.

The internal HTTP client now fails a request with a timeout when the connection makes no I/O progress for 120 seconds. Previously the request stalled until TCP retransmission gave up, about 15 minutes, when a remote endpoint hung.

Reconnection logic is hardened when inter-broker heartbeat requests hit a connection timeout.

Cross-shard partition movements now transfer the local log_eviction_stm snapshot. Previously the missing snapshot led to full local log replays.

A new redpanda_schema_registry_loaded_offset metric surfaces the last offset from the Schema Registry’s internal _schemas topic applied to the local store.