Detections
Analytics

Echo: org.apache.kafka:kafka-clients: security update to 3.9.2

high Tenable Self-Hosted Container Security Plugin ID 457255

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to
 be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a
 network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely
 deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a
 different topic—reuses this freed buffer before the original network request completes, the buffer
 contents may become corrupted. This can result in messages being delivered to unintended topics without
 any error being reported to the producer. Data Confidentiality: Messages intended for one topic may be
 delivered to a different topic, potentially exposing sensitive data to consumers who have access to the
 destination topic but not the intended source topic. Data Integrity: Consumers on the receiving topic may
 encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and
 corrupted downstream data. This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and ≤ 4.1.1. Kafka
 users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.
 (CVE-2026-35554)

Solution

Update the org.apache.kafka:kafka-clients library and its related packages to version 3.9.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-35554

Plugin Details

Severity: High

ID: 457255

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 57.62

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-35554

CVSS v3

Risk Factor: High

Base Score: 8.7

Temporal Score: 7.6

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 4/7/2026

Reference Information

CVE: CVE-2026-35554