Race Condition in Apache Kafka Java Producer Client Buffer Management

CVE-2026-35554

What is CVE-2026-35554?

A race condition in the buffer management system of the Apache Kafka Java producer client can lead to messages being mistakenly delivered to incorrect topics. This occurs when a produce batch's delivery timeout is reached while the corresponding network request is still in progress. If the batch's ByteBuffer is deallocated and reused for a subsequent batch intended for a different topic prior to the original request's completion, the message contents may be corrupted. This vulnerability poses risks to data confidentiality, allowing sensitive data to be exposed to unauthorized consumers, and may also compromise data integrity by causing deserialization failures and processing errors in the receiving topic.

References