v25.3.17

Features

• adds the cloud_storage_prefetch_segments_max cluster config which can be used to enable small segment prefetching in cloud storage. by @ballard26 in #29795

Bug Fixes

• Reverted the c-ares DNS resolver from 1.34.7 back to 1.34.6. c-ares 1.34.7 contains an upstream regression (c-ares/c-ares#1256) where a DNS query's completion callback can silently never be invoked, which could leave an internal broker-to-broker RPC connection permanently unable to reconnect after a peer broker restart. Affected clusters showed persistently under-replicated partitions and failing broker readiness probes, even though the remaining replicas kept a healthy quorum and continued serving traffic. Reverting c-ares reintroduces CVE-2026-33630. The CVE fix will be re-applied once an upstream c-ares release fixes the regression. by @pgellert in #31637
• Fixed a memory over-allocation in the Kafka fetch path where a partition with an inflated max.message.bytes (e.g. UINT32_MAX) could monopolize the entire shard's fetch memory budget, starving other partitions and causing fetch timeouts or broker OOM. by @ballard26 in #30314
• Fixed an audit initialization deadlock where the audit subsystem would retry indefinitely waiting for a controller leader, permanently wedging startup on clusters without an elected leader. Audit initialization now reads the local topic table directly and marks the subsystem misconfigured rather than silently dropping records. by @bartoszpiekny-redpanda in #31587
• #31552 rpk connect upgrade no longer fails to determine the currently-installed Redpanda Connect version when that version has a segment of three or more digits, which had blocked upgrading any Connect install since 4.100.0. by @JakeSCahill in #31553

Full Changelog: v25.3.16...v25.3.17