CVE-2026-35554 Apache CVE debrief

Who should care

Apache Kafka users, administrators, and security teams should be aware of this vulnerability and take necessary actions to upgrade to patched versions and monitor their Kafka installations. Affected operators should review their deployments and ensure that they are running a patched version of Kafka. Vulnerability management and security teams should prioritize this issue due to its potential impact on data confidentiality and integrity.

Technical summary

A race condition in the Apache Kafka Java producer client's buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch's ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.

Defensive priority

Kafka users should prioritize upgrading to patched versions to prevent potential data exposure and integrity issues.

Recommended defensive actions

• Upgrade to Apache Kafka version 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later.
• Review and update affected Kafka installations to prevent potential data exposure and integrity issues.
• Monitor Kafka logs and metrics for suspicious activity.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and recommended actions. Evidence is limited to public sources and may not cover all affected deployments. Defenders should verify Kafka installations, review logs, and monitor for suspicious activity. The issue's severity and potential impact suggest that users should prioritize upgrading to patched versions. Additional information can be found in the Apache Kafka documentation and security advisories.

Official resources