Redpanda v25.3.16

Bug Fixes

• Changes to cloud_storage_throughput_limit_percent cluster config now take effect at runtime instead of being ignored until restart. by @nvartolomei in #30232
• Fix consumer group lag metrics inflated after retention or trim-prefix. by @bartoszpiekny-redpanda in #30902
• Fix consumer group lag metrics reporting 0 for read-replica topics. by @bartoszpiekny-redpanda in #30950
• Fixed a crash that could occur when removing a partition with a very large number of log segments, e.g. during partition rebalancing. by @pgellert in #31504
• Fixed a crash where a snapshot write failing on a full disk (ENOSPC) aborted the node with a misleading "snapshot writer has to be closed" assertion instead of surfacing the I/O error. by @nvartolomei in #31188
• Fixed a double-free / use-after-free in c-ares query-completion handling (CVE-2026-33630). by @bartoszpiekny-redpanda in #31485
• Fixed a leak in the Iceberg translation subsystem where per-partition metrics were not released after a partition was removed from a broker. by @nvartolomei in #30705
• Fixed a race in the internal Kafka client where a concurrent request on a freshly established SASL connection could be sent before authentication finished, causing the broker to drop the connection. by @nvartolomei in #31191
• Fixes a bug in OffsetForLeaderEpoch handling with tiered topics which could cause consumers to reset their fetch position to the beginning of the log held in cloud storage. by @WillemKauf in #31075
• Fixes a bug in which a generate_report() request to the transform system could result in a nullptr dereference at startup. by @WillemKauf in #30911
• Fixes a bug in which hung requests to the schema registry or in shadow linking could cause a deadlock during shutdown. by @WillemKauf in #30789
• Fixes a reactor stall seen when there are a large number of pending files in the Iceberg Topics coordinator. by @andrwng in #30881
• Fixes a wedge in multi-output transforms where a produce failure on one output topic silently stalled the processor instead of restarting it. by @WillemKauf in #30856
• HTTP Proxy: Consumer group fetches no longer fail indefinitely with offset_out_of_range after retention moves a topic's log start offset past 0; the consumer now recovers to the earliest available offset (auto.offset.reset=earliest). by @bartoszpiekny-redpanda in #31208
• Lifecycle fix on groups. by @joe-redpanda in #31183
• Upgrade krb5 to 1.22.2 to address CVE-2026-40355 and CVE-2026-40356 (NegoEx parsing vulnerabilities). by @tyson-redpanda in #30875
• Upgraded Go toolchain to 1.26.5 to address CVE-2026-39822 (os.Root symlink escape). by @bartoszpiekny-redpanda in #31487
• Upgraded OpenSSL from 3.0.20 to 3.0.21 to resolve CVEs fixed in the 3.0.21 release (2026-06-09). by @tyson-redpanda in #30812
• Fixed a rare condition where Tiered Storage metadata spillover could get permanently stuck on partitions with small, frequent segments, repeatedly logging "Can't apply spillover_cmd" and leaving orphaned spillover manifest objects in the bucket. by @Lazin in #31464
• Fixed an allocation double-free triggered by no-op replication-factor changes. by @joe-redpanda in #31194
• Fixes a bug in which internal topics could be auto-created with the wrong topic properties. by @WillemKauf in #31241
• Fixed a raft pre-vote livelock where a follower recovering behind a live leader could repeatedly start elections, leaving partitions under-replicated and stalling acks=all produce with request timeouts. by @stevenpall in #31255
• Broker-internal authorisation probes (metadata visibility filtering, init_producer_id write fall back, OffsetForLeaderEpoch cluster_action fast path) no longer emit denied-access audit events attributed to the client. by @JFlath in #31325
• OffsetForLeaderEpoch no longer logs a spurious authz failure for non-superuser consumers. by @JFlath in #31325
• rpk connect install --connect-version no longer rejects versions with a segment of three or more digits, which had blocked pinning any Redpanda Connect release since 4.100.0. by @prakhargarg105 in #31451

Improvements

• Avoid oversized allocations for some of the schema_registry and pandaproxy handler interfaces. by @WillemKauf in #31201
• HTTP Proxy: a consumer group now resumes from its committed offset on a fresh consumer instance instead of re-reading from the earliest available offset. by @bartoszpiekny-redpanda in #31224
• Iceberg Topics will stop creating new parquet files if there is a large backlog of files not yet committed to the Iceberg catalog. This helps avoid an OOM when the catalog has rejected Redpanda commits for prolonged periods of time. by @andrwng in #31037
• Improves false positive detection in the cloud storage scrubber to filter out compacted reuploads. by @oleiman in #30121
• Make the fetch path more resilient to errors in single partitions. by @WillemKauf in #30112
• Prevent oversized allocations in the kafka layer when utilizing large consumer groups. by @WillemKauf in #30752
• Purging an Iceberg table managed by the filesystem catalog will now delete all the table's files, not just the metadata files. by @wdberkeley in #30700
• The Iceberg Topics Coordinator will now commit to the Iceberg catalog in chunks, avoiding an OOM when the catalog has rejected Redpanda commits for prolonged periods of time. by @andrwng in #31037
• rpk cluster health will now display any nodes that may be in maintenance mode. by @alextreichler in #31351
• Adds stuck raft0 escape hatches. by @joe-redpanda in #31198
• Decommission may now cancel a stalled cluster node add. by @joe-redpanda in #30661

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v25.3.15...v25.3.16