Closing since it is a vulnerability on Kafka Connector in strimzi [0], not in kafka package. [0] https://github.com/strimzi/strimzi-kafka-operator