CVE-2026-35554

When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.

Data Confidentiality: Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.

Data Integrity: Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.

This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and ≤ 4.1.1.

Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-362",
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35554.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.8.0"
                },
                {
                    "last_affected": "3.9.1"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.1"
                },
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.1"
                }
            ]
        }
    ],
    "cna_assigner": "apache"
}

References

Affected packages

Git / github.com/apache/kafka

Affected ranges

Type

GIT

Repo

https://github.com/apache/kafka

Events

Introduced

ebb1d6e21cc9213071ee1c6a15ec3411fc215b81

Fixed

5e9866f43ab8e7e41ef39e5584ac50019381328d

Introduced

985bc99521dd22bbf620591b8db8613c54f596b2

Fixed

5d0fe56677f97d9525843963f1ffe329d2b69433

Introduced

13f70256db3c994c590e5d262a7cc50b9e973204

Fixed

c82fd9b934b4c1e6fa799e3f1dcc8f08d997740c

Database specific

Show details

{
    "cpe": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "2.8.0"
        },
        {
            "fixed": "3.9.2"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.2"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.2"
        }
    ]
}

Affected versions

4.*

4.1.0

4.1.0-rc3

4.1.1

4.1.1-rc1

4.1.1-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35554.json"