# Redpanda v25.3.15

- Product: Redpanda (https://whatsnew.fyi/product/redpanda)
- Vendor: Redpanda Data
- Date: 2026-06-04
- Version: v25.3.15
- Original notes: https://github.com/redpanda-data/redpanda/releases/tag/v25.3.15
- Permalink: https://whatsnew.fyi/product/redpanda/releases/v25.3.15

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add OAUTHBEARER SASL mechanism support to rpk, enabling OIDC-based authentication for the Kafka client, admin API, and schema registry via --password and --sasl-mechanism OAUTHBEARER
- **fixed** — Allow combining aws_sigv4 Iceberg REST catalog authentication with the sts cloud credentials source
- **fixed** — Correctly decode variable-length Avro decimal payloads on the ingest path
- **fixed** — Fix Iceberg map columns being unreadable from strict Parquet readers due to missing LogicalType.MAP annotation in the written Parquet schema
- **fixed** — Fix a process abort when the tiered storage cache's local disk fills up while a segment download is in progress on a non-zero shard
- **fixed** — Fix corruption of negative decimal partition values in Iceberg manifests for decimal columns whose precision does not require 16 bytes
- **fixed** — Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields
- **fixed** — Fix tiered storage I/O remaining throttled at the previously-configured rate after cloud_storage_max_throughput_per_shard was unset
- **fixed** — Fix Avro schema lookup false negatives when equivalent nested primitive schemas used simple form and object form
- **fixed** — Fix schema registry returning 40403 when looking up Avro schemas that use unqualified named type references against registered schemas using fully-qualified references
- **fixed** — Fix the vectorized_rpc_client_requests_pending gauge drifting over time
- **fixed** — Fix a bug in the feature_table in which nodes holding back cluster-wide cluster_version, when decommissioned, result in cluster_version never being updated until a restart or controller leadership move
- **fixed** — Fix a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added
- **fixed** — Fix an issue that prevented raft followers across high-RTT links from establishing connections long enough to receive heartbeat request replies
- **security** — Patch krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing
- **security** — Upgrade OpenSSL from 3.0.19 to 3.0.20 to address CVE-2026-31790, which could allow an attacker supplying a malformed RSA public key to trigger use of uninitialized memory
- **security** — Upgrade libxml2 to v2.15.3 to fix CVE-2026-6732 type confusion vulnerability in XSD validation
- **fixed** — Fix protobuf compatibility checks incorrectly failing with MESSAGE_REMOVED when a map field is removed
- **fixed** — Fix a bug in which a double metric registration could occur when sts credentials were used for both iceberg and tiered_storage systems
- **changed** — Backport features_auto_finalization cluster configuration option to allow opting out of automatic upgrade finalization

##### Features
* Add OAUTHBEARER SASL mechanism support to rpk, enabling OIDC-based authentication for the Kafka client, admin API, and schema registry. Pass the token via --password (raw value or token:<TOKEN> format) with --sasl-mechanism OAUTHBEARER. by @david-yu in [#30312](https://github.com/redpanda-data/redpanda/pull/30312)
##### Bug Fixes
* Allow combining `aws_sigv4` Iceberg REST catalog authentication with the `sts` cloud credentials source. by @nvartolomei in [#30554](https://github.com/redpanda-data/redpanda/pull/30554)
* Correctly decode variable-length Avro `decimal` payloads on the
ingest path. by @nvartolomei in [#30518](https://github.com/redpanda-data/redpanda/pull/30518)
* Fix Iceberg map columns being unreadable from strict Parquet readers
(e.g. Apache Spark) due to a missing `LogicalType.MAP` annotation in
the written Parquet schema. by @nvartolomei in [#30458](https://github.com/redpanda-data/redpanda/pull/30458)
* Fix a process abort when the tiered storage cache's local disk fills
up while a segment download is in progress on a non-zero shard. by @nvartolomei in [#30352](https://github.com/redpanda-data/redpanda/pull/30352)
* Fix corruption of negative decimal partition values in Iceberg
manifests for decimal columns whose precision does not require 16
bytes (e.g. `decimal(10,2)`). by @nvartolomei in [#30518](https://github.com/redpanda-data/redpanda/pull/30518)
* Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields (e.g. maps, whose keys are always required). by @nvartolomei in [#30591](https://github.com/redpanda-data/redpanda/pull/30591)
* Fix tiered storage I/O remaining throttled at the previously-configured rate after `cloud_storage_max_throughput_per_shard` was unset. by @nvartolomei in [#30472](https://github.com/redpanda-data/redpanda/pull/30472)
* Fixed Avro schema lookup false negatives when equivalent nested primitive schemas used simple form, such as `"string"`, and object form, such as `{"type":"string"}`. by @pgellert in [#30642](https://github.com/redpanda-data/redpanda/pull/30642)
* Fixed schema registry returning 40403 when looking up Avro schemas that use unqualified named type references (e.g. `"Inner"`) against registered schemas using fully-qualified references (e.g. `"com.example.Inner"`) within
the same namespace. by @ksitnik-tc in [#30267](https://github.com/redpanda-data/redpanda/pull/30267)
* Fixed the `vectorized_rpc_client_requests_pending` gauge drifting
over time. by @nvartolomei in [#30297](https://github.com/redpanda-data/redpanda/pull/30297)
* Fixes a bug in the `feature_table` in which nodes which are holding back the cluster-wide `cluster_version`, when decommissioned, result in the `cluster_version` never being updated until a restart/controller leadership move is forced. by @WillemKauf in [#30634](https://github.com/redpanda-data/redpanda/pull/30634)
* Fixes a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added. by @wdberkeley in [#30639](https://github.com/redpanda-data/redpanda/pull/30639)
* Fixes an issue that prevented raft followers across high-RTT links from establishing connections long enough to receive heartbeat request replies.  by @ballard26 in [#30550](https://github.com/redpanda-data/redpanda/pull/30550)
* Patched krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing, both exploitable by an unauthenticated remote attacker to crash the process (CVSS 8.7). by @tyson-redpanda in [#30571](https://github.com/redpanda-data/redpanda/pull/30571)
* Upgraded OpenSSL from 3.0.19 to 3.0.20 to address CVE-2026-31790, which could allow an attacker supplying a malformed RSA public key to trigger use of uninitialized memory during RSA key encapsulation. by @tyson-redpanda in [#30239](https://github.com/redpanda-data/redpanda/pull/30239)

_[Truncated at 4000 characters — full notes: https://github.com/redpanda-data/redpanda/releases/tag/v25.3.15]_