RHLW-2026-f7c61b4b79130a3c

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f7c61b4b79130a3c.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f7c61b4b79130a3c.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-f7c61b4b79130a3c
Upstream
CVE (4)
GHSA (4)
Published
2026-10-15T01:32:14Z
Modified
2026-10-27T08:58:02Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Lightwell Security Advisory: kafka-clients 3.6.2.rhlw-00004
Details

Red Hat Lightwell has released org.apache.kafka:kafka-clients 3.6.2.rhlw-00004 with backported fixes for CVE-2024-31141, CVE-2025-27817, CVE-2026-33558, and CVE-2026-35554.

CVE-2024-31141: Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

CVE-2025-27817: Apache Kafka Client: Arbitrary file read and SSRF vulnerability

CVE-2026-33558: Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output

CVE-2026-35554: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

This patched artifact is a drop-in replacement for org.apache.kafka:kafka-clients 3.6.2 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.apache.kafka:kafka-clients

Package

Name
org.apache.kafka:kafka-clients
Purl
pkg:maven/org.apache.kafka/kafka-clients

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.6.2.rhlw-00004

Affected versions

0.*
0.8.2-beta
0.8.2.0
0.8.2.1
0.8.2.2
0.9.0.0
0.9.0.1
0.10.0.0
0.10.0.1
0.10.1.0
0.10.1.1
0.10.2.0
0.10.2.1
0.10.2.2
0.11.0.0
0.11.0.1
0.11.0.2
0.11.0.3
1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.4.0
2.4.1
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.7.2
2.8.0
2.8.1
2.8.2
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
3.2.2
3.2.3
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.6.0
3.6.1
3.6.2

Database specific

lightwell 
{
    "backport_base_version":  "3.6.2",
    "remediated_version":  "3.6.2.rhlw-00004",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f7c61b4b79130a3c.json"