CVE-2026-35554: Apache Kafka Clients - Message Corruption and Misrouting via Buffer Pool Race Condition
Summary
CVE-2026-35554: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition. Affects org.apache.kafka:kafka-clients across 3 version ranges.
>= 2.8.0, < 3.9.2
>= 4.0.0, < 4.0.2
>= 4.1.0, < 4.1.2
Fixed in 3.9.2, 4.0.2 or 4.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is a distributed event streaming platform capable of handling trillions of events a day. It is designed for high-throughput, fault-tolerant, and scalable messaging. The Kafka clients, particularly the Java producer client, are essential for sending messages to Kafka topics. However, a race condition in the buffer pool management of these clients can lead to severe issues, including message misrouting and corruption.
Vulnerability Detail
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer. This vulnerability can lead to data confidentiality issues, where sensitive messages may be exposed to unauthorized consumers, and data integrity issues, where consumers may encounter unexpected messages, leading to processing errors.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.8.0, < 3.9.23.9.2 -
>= 4.0.0, < 4.0.24.0.2 -
>= 4.1.0, < 4.1.24.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can implement additional logging to monitor message delivery and validate that messages are being sent to the correct topics. However, upgrading to the patched versions is the recommended solution.
Conclusion
The Apache Kafka Clients vulnerability CVE-2026-35554 poses significant risks related to message corruption and misrouting due to a race condition in buffer pool management. Users are strongly advised to upgrade to the latest patched versions to mitigate these risks.
See every vulnerability recorded for org.apache.kafka:kafka-clients →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
This vulnerability affects Apache Kafka versions 3.9.1 and earlier, 4.0.1 and earlier, and 4.1.1 and earlier.
The risks include unintended message delivery to incorrect topics, potential exposure of sensitive data, and data integrity issues leading to processing errors.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If immediate upgrading is not possible, implement logging to monitor message delivery and validate that messages are sent to the correct topics until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka-clients.
