ZK 10.3.1 release notes

PE/EE released on Jul 21, 2026

ZK 10.3.1 resolves several key issues and updates third-party dependencies to their latest secure versions. We encourage all users on the ZK 10 branch to upgrade to this release to keep your applications running smoothly and safely.

Please note that this version is released for PE/EE customers & ZOL users.

Demo

Download

What's New

• Bugs Fixed
• ZK-6011 - an invalid post request still gets the http response 200
• ZK-6075 - URL exception in IBM WebSphere / Open Liberty
• ZK-6092 - DOMPurify: Fix XSS vulnerabilities CVE-2026-0540 and CVE-2025-15599
• ZK-6102 - SimpleDesktopCache _cleanup timers are not removed, cause Tomcat errors on application stop
• ZK-6127 - Upgrade dompurify to 3.4.11
• ZK-6130 - Upgrade dependencies to fix security vulnerabilities