From 9b0eddd6341f4ee4276482dc4a42e04be33b7f46 Mon Sep 17 00:00:00 2001
From: Aditya Addepalli <aaddepalli@confluent.io>
Date: Thu, 28 May 2026 13:03:30 -0500
Subject: [PATCH] Bump log4j2 to 2.25.4 for CVE fixes on FedRAMP branch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pom.xml b/pom.xml
index 0935161412..0e8263cde4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -59,6 +59,7 @@
         <io.confluent.rest-utils.version>8.0.2</io.confluent.rest-utils.version>
         <conscrypt.version>2.5.2</conscrypt.version>
         <spiffe.version>0.8.13</spiffe.version>
+        <log4j2.version>2.25.4</log4j2.version>
     </properties>
 
     <repositories>