Currently Flink uses Kryo as the default serializer for data types that Flink's type serialization stack doesn't support [1]. This also includes serializers being used for managed state registered by users.
Because of this, at the moment it's not easy to upgrade the Kryo version, since it is known to be binary incompatible across major versions [2]. Therefore, upgrading Kryo would also mean we would be breaking backwards compatibility for Flink's savepoints between Flink minor version releases [3], which is something the community decided to maintain as part of Flink's backward compatibility policy.