Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Kafka, SonarQube and Spark need update to stay secure
published 1 month ago
Summary
The listed Kafka, SonarQube and Spark packages contain a known security weakness that has been fixed in newer versions. Running the older releases could expose your systems to potential attacks. Update each product to the latest available release as soon as possible.
What to do
- Update cleanstart kafka to version 4.0.1-r4.
- Update cleanstart kafka to version 4.0.2-r0.
- Update cleanstart kafka to version 4.1.2-r0.
- Update cleanstart kafka-fips to version 4.0.2-r1.
- Update cleanstart sonarqube to version 25.12.0.117093-r3.
- Update cleanstart sonarqube to version 26.4.0.121862-r2.
- Update cleanstart spark-sc213-jdk17-py311 to version 4.1.1-r2.
- Update kafka to version 4.0.1-r4.
- Update kafka to version 4.0.2-r0.
- Update kafka to version 4.1.2-r0.
- Update kafka-fips to version 4.0.2-r1.
- Update sonarqube to version 25.12.0.117093-r3.
- Update sonarqube to version 26.4.0.121862-r2.
- Update spark-sc213-jdk17-py311 to version 4.1.1-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | kafka |
< 4.0.1-r4 < 4.0.2-r0 < 4.1.2-r0 Fix: upgrade to 4.0.1-r4
|
| CleanStart | cleanstart | kafka-fips |
< 4.0.2-r1 Fix: upgrade to 4.0.2-r1
|
| CleanStart | cleanstart | sonarqube |
< 25.12.0.117093-r3 < 26.4.0.121862-r2 Fix: upgrade to 25.12.0.117093-r3
|
| CleanStart | cleanstart | spark-sc213-jdk17-py311 |
< 4.1.1-r2 Fix: upgrade to 4.1.1-r2
|
| CleanStart | – | kafka |
< 4.0.1-r4 < 4.0.2-r0 < 4.1.2-r0 Fix: upgrade to 4.0.1-r4
|
| CleanStart | – | kafka-fips |
< 4.0.2-r1 Fix: upgrade to 4.0.2-r1
|
| CleanStart | – | sonarqube |
< 25.12.0.117093-r3 < 26.4.0.121862-r2 Fix: upgrade to 25.12.0.117093-r3
|
| CleanStart | – | spark-sc213-jdk17-py311 |
< 4.1.1-r2 Fix: upgrade to 4.1.1-r2
|
Original advisory text
Security fix for GHSA-h383-gmxw-35v2 applied in: kafka 4.0.1-r4, kafka 4.0.2-r0, kafka 4.1.2-r0, kafka-fips 4.0.2-r1, sonarqube 25.12.0.117093-r3, sonarqube 26.4.0.121862-r2, spark-sc213-jdk17-py311 4.1.1-r2
GHSA-h383-gmxw-35v2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Severity
7.5
High
Timeline
Published18 Sep 2026
Updated15 Oct 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-NL43370 · OSV
Track software like this
Free during beta