CVE-2026-35554

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 3.9.2 Apache Kafka versions prior to 4.0.2 Apache Kafka versions prior to 4.1.2

Description A race condition in the Java producer client's buffer pool management can lead to messages being silently delivered to incorrect topics. This occurs when a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, causing the batch's ByteBuffer to be prematurely deallocated and returned to the buffer pool. If a subsequent producer batch reuses this freed buffer before the original request completes, the buffer contents may be corrupted. This results in data confidentiality risks, as sensitive information may be exposed to unauthorized consumers, and data integrity risks, as receiving topics may encounter incompatible messages leading to deserialization failures and processing errors.

Recommendations Upgrade to version 3.9.2 or later. Upgrade to version 4.0.2 or later. Upgrade to version 4.1.2 or later.