CVE-2026-35554

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35554", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-04-03T11:08:30.442Z", "datePublished": "2026-04-07T13:07:08.679Z", "dateUpdated": "2026-04-07T16:23:31.521Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kafka:kafka-clients", "product": "Apache Kafka Clients", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.9.1", "status": "affected", "version": "2.8.0", "versionType": "semver"}, {"lessThanOrEqual": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.1.1", "status": "affected", "version": "4.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Bharath Vissapragada <bharathv@apache.org>"}, {"lang": "en", "type": "finder", "value": "Donny Nadolny <donny.nadolny@hotmail.com>"}, {"lang": "en", "type": "remediation developer", "value": "Donny Nadolny <donny.nadolny@hotmail.com>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>A race condition in the <strong>Apache Kafka Java producer client\u2019s buffer pool management</strong> can cause messages to be silently delivered to incorrect topics.</p><p>When a produce batch expires due to <code>delivery.timeout.ms</code> while a network request containing that batch is still in flight, the batch\u2019s <code>ByteBuffer</code> is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch\u2014potentially destined for a different topic\u2014reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.<br></p><p><strong>Data Confidentiality:</strong><br>Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.</p><p><strong>Data Integrity:</strong><br>Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.</p><p>This issue affects <strong>Apache Kafka versions \u2264 3.9.1, \u2264 4.0.1, and&nbsp; \u2264 4.1.1</strong>.</p><p>Kafka users are advised to upgrade to <strong>3.9.2, 4.0.2, 4.1.2, 4.2.0, or later</strong> to address this vulnerability.</p><br><p></p>"}], "value": "A race condition in the Apache Kafka Java producer client\u2019s buffer pool management can cause messages to be silently delivered to incorrect topics.\n\nWhen a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch\u2019s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch\u2014potentially destined for a different topic\u2014reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.\n\n\nData Confidentiality:\nMessages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.\n\nData Integrity:\nConsumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.\n\nThis issue affects Apache Kafka versions \u2264 3.9.1, \u2264 4.0.1, and\u00a0 \u2264 4.1.1.\n\nKafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-07T13:07:08.679Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://issues.apache.org/jira/browse/KAFKA-19012"}, {"tags": ["mailing-list", "vendor-advisory"], "url": "https://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T13:57:17.254124Z", "id": "CVE-2026-35554", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:58:08.252Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/07/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-07T16:23:31.521Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/07/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-07T16:23:31.521Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-35554", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T13:57:17.254124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:56:22.085Z"}}], "cna": {"title": "Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Bharath Vissapragada <bharathv@apache.org>"}, {"lang": "en", "type": "finder", "value": "Donny Nadolny <donny.nadolny@hotmail.com>"}, {"lang": "en", "type": "remediation developer", "value": "Donny Nadolny <donny.nadolny@hotmail.com>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka Clients", "versions": [{"status": "affected", "version": "2.8.0", "versionType": "semver", "lessThanOrEqual": "3.9.1"}, {"status": "affected", "version": "4.0.0", "versionType": "semver", "lessThanOrEqual": "4.0.1"}, {"status": "affected", "version": "4.1.0", "versionType": "semver", "lessThanOrEqual": "4.1.1"}], "packageName": "org.apache.kafka:kafka-clients", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://issues.apache.org/jira/browse/KAFKA-19012", "tags": ["issue-tracking"]}, {"url": "https://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6", "tags": ["mailing-list", "vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A race condition in the Apache Kafka Java producer client\u2019s buffer pool management can cause messages to be silently delivered to incorrect topics.\n\nWhen a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch\u2019s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch\u2014potentially destined for a different topic\u2014reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.\n\n\nData Confidentiality:\nMessages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.\n\nData Integrity:\nConsumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.\n\nThis issue affects Apache Kafka versions \u2264 3.9.1, \u2264 4.0.1, and\u00a0 \u2264 4.1.1.\n\nKafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<p></p><p>A race condition in the <strong>Apache Kafka Java producer client\u2019s buffer pool management</strong> can cause messages to be silently delivered to incorrect topics.</p><p>When a produce batch expires due to <code>delivery.timeout.ms</code> while a network request containing that batch is still in flight, the batch\u2019s <code>ByteBuffer</code> is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch\u2014potentially destined for a different topic\u2014reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.<br></p><p><strong>Data Confidentiality:</strong><br>Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.</p><p><strong>Data Integrity:</strong><br>Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.</p><p>This issue affects <strong>Apache Kafka versions \u2264 3.9.1, \u2264 4.0.1, and&nbsp; \u2264 4.1.1</strong>.</p><p>Kafka users are advised to upgrade to <strong>3.9.2, 4.0.2, 4.1.2, 4.2.0, or later</strong> to address this vulnerability.</p><br><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-07T13:07:08.679Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35554", "state": "PUBLISHED", "dateUpdated": "2026-04-07T16:23:31.521Z", "dateReserved": "2026-04-03T11:08:30.442Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-07T13:07:08.679Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kafka:kafka-clients", "product": "Apache Kafka Clients", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.9.1", "status": "affected", "version": "2.8.0", "versionType": "semver"}, {"lessThanOrEqual": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.1.1", "status": "affected", "version": "4.1.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD64E63F-1C04-42C6-8EB8-AD20E98D0E6D", "versionEndExcluding": "3.9.2", "versionStartIncluding": "2.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C7447C7-C7BE-46B6-B4B6-DD95BA5CDBF8", "versionEndExcluding": "4.0.2", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D700BB3-89AD-4488-8820-17C427E7983D", "versionEndExcluding": "4.1.2", "versionStartIncluding": "4.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A race condition in the Apache Kafka Java producer client\u2019s buffer pool management can cause messages to be silently delivered to incorrect topics.\n\nWhen a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch\u2019s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch\u2014potentially destined for a different topic\u2014reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.\n\n\nData Confidentiality:\nMessages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.\n\nData Integrity:\nConsumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.\n\nThis issue affects Apache Kafka versions \u2264 3.9.1, \u2264 4.0.1, and\u00a0 \u2264 4.1.1.\n\nKafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability."}, {"lang": "es", "value": "Una condici\u00f3n de carrera en la gesti\u00f3n del pool de b\u00faferes del cliente productor Java de Apache Kafka puede causar que los mensajes sean entregados silenciosamente a temas incorrectos.\n\nCuando un lote de producci\u00f3n expira debido a delivery.timeout.ms mientras una solicitud de red que contiene ese lote todav\u00eda est\u00e1 en vuelo, el ByteBuffer del lote es desasignado prematuramente y devuelto al pool de b\u00faferes. Si un lote de productor subsiguiente -potencialmente destinado a un tema diferente- reutiliza este b\u00fafer liberado antes de que la solicitud de red original se complete, el contenido del b\u00fafer puede corromperse. Esto puede resultar en que los mensajes sean entregados a temas no deseados sin que se informe ning\u00fan error al productor.\n\nConfidencialidad de los datos:\nLos mensajes destinados a un tema pueden ser entregados a un tema diferente, exponiendo potencialmente datos sensibles a consumidores que tienen acceso al tema de destino pero no al tema de origen previsto.\n\nIntegridad de los datos:\nLos consumidores en el tema receptor pueden encontrar mensajes inesperados o incompatibles, lo que lleva a fallos de deserializaci\u00f3n, errores de procesamiento y datos descendentes corruptos.\n\nEste problema afecta a las versiones de Apache Kafka ? 3.9.1, ? 4.0.1 y ? 4.1.1.\n\nSe aconseja a los usuarios de Kafka que actualicen a 3.9.2, 4.0.2, 4.1.2, 4.2.0, o posterior para abordar esta vulnerabilidad."}], "id": "CVE-2026-35554", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.8, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35554", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T13:57:17.254124Z", "version": "2.0.3"}}]}, "published": "2026-04-07T14:16:23.413", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking"], "url": "https://issues.apache.org/jira/browse/KAFKA-19012"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/07/6"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-416"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management", "id": "2455916", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455916"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer deallocation and potential reuse by other messages. Consequently, sensitive data may be exposed to unauthorized consumers, and data integrity can be compromised through deserialization failures and processing errors."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-35554", "package_state": [{"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Apicurio Registry 2"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:2", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Debezium 2"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "log4j:2/log4j", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "log4j", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "kafka-clients", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Out of support scope", "package_name": "kafka-clients", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Out of support scope", "package_name": "kafka-clients", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Out of support scope", "package_name": "kafka-clients", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "kafka-clients", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-04-07T13:07:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-35554\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35554\nhttps://issues.apache.org/jira/browse/KAFKA-19012\nhttps://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.8.0,3.9.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Kafka Clients", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kafka", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-21T23:25:08.665648+00:00", "value": {"mitigation_remediation": ["Upgrade all Kafka client instances to at least 3.9.2, 4.0.2, 4.1.2, or 4.2.0.", "Ensure that all production and testing environments deploy the updated client library and redeploy producer applications.", "Enable monitoring for unexpected message routing events and review consumer logs for deserialization errors or data anomalies."], "summary": {"action": "Upgrade Immediately", "impact": "Message corruption and misrouting leading to data confidentiality and integrity violations"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Apache Kafka clients from versions up to and including 3.9.1, 4.0.1, and 4.1.1. Users should update to version 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to remediate the flaw.", "description_and_impact": "A race condition in the Apache Kafka Java producer client\u2019s buffer pool causes a produced batch to expire while still travelling on the network. The batch\u2019s ByteBuffer is released prematurely and may be reused for another batch destined for a different topic. The result is that messages are silently delivered to unintended topics, exposing data to unauthorized consumers and corrupting downstream processing. This flaw can lead to significant confidentiality and integrity risks because the producer receives no error notification.", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity attack with potential for major impact. The EPSS score is < 1%, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no public exploits have been reported. The likely attack vector is through any active producer client that can send a high volume of produce requests to a Kafka cluster, attempting to trigger the race condition. Successful exploitation would not require privileged access; it merely needs network connectivity to the producer and Kafka broker, which are common in many deployments."}}}}, "created": "2026-04-08T19:49:28.976504+00:00", "updated": "2026-04-21T23:30:02.882937+00:00", "vendors": ["apache", "apache$PRODUCT$kafka"]}