Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-35554— Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

Quick assessment

Affected
Apache Software Foundation Apache Kafka Clients
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Kafka是美国阿帕奇（Apache）基金会的一套开源的分布式流媒体平台。该平台能够获取实时数据，用于构建对数据流的变化进行实时反应的应用程序。 Apache Kafka 3.9.1及之前版本、4.0.1及之前版本和4.1.1及之前版本存在安全漏洞，该漏洞源于Java生产者客户端缓冲区池管理中的竞争条件，可能导致消息被静默传递到错误的主题，从而泄露敏感数据或导致下游数据处理错误。

AI Predicted 5.9 Difficulty: Theoretical EPSS 0.65% · P49
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-35554

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Source: CVE Program / CVE List V5
Vulnerability Description
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer. Data Confidentiality: Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic. Data Integrity: Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data. This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and  ≤ 4.1.1. Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Kafka 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Kafka是美国阿帕奇（Apache）基金会的一套开源的分布式流媒体平台。该平台能够获取实时数据，用于构建对数据流的变化进行实时反应的应用程序。 Apache Kafka 3.9.1及之前版本、4.0.1及之前版本和4.1.1及之前版本存在安全漏洞，该漏洞源于Java生产者客户端缓冲区池管理中的竞争条件，可能导致消息被静默传递到错误的主题，从而泄露敏感数据或导致下游数据处理错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Kafka Clients 2.8.0 ~ 3.9.1 -

II. Public POCs for CVE-2026-35554

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-35554

请登录查看更多情报信息。

Same Patch Batch · Apache Software Foundation · 2026-04-07 · 6 CVEs total

CVE-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could pe
CVE-2026-33227 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web,
CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
CVE-2026-27315 Apache Cassandra: cqlsh history sensitive information leak
CVE-2026-32588 Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing

IV. Related Vulnerabilities

Same product: Apache Kafka Clients
Same vendor: Apache Software Foundation
Same weakness: CWE-416

V. Comments for CVE-2026-35554

No comments yet

Leave a comment