CVE-2026-35554: 
Java vulnerability analysis and mitigation

CVE-2026-35554 is a race condition vulnerability in the Apache Kafka Java producer client's buffer pool management, officially titled "Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition." It affects org.apache.kafka:kafka-clients versions 2.8.0 through 3.9.1, 4.0.0 through 4.0.1, and 4.1.0 through 4.1.1. The vulnerability was disclosed on April 7, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, oss-security).

The root cause is a concurrent execution race condition (CWE-362) combined with a use-after-free pattern (CWE-416) in the Kafka producer client's BufferPool. When a produce batch expires due to delivery.timeout.ms while its associated network request is still in flight, the batch's ByteBuffer is prematurely returned to the buffer pool. A subsequent producer batch — potentially targeting a different topic — may then reuse this freed buffer before the original network request completes, corrupting the buffer contents. The result is that messages are silently delivered to unintended topics with no error surfaced to the producer application. The vulnerability was found by Donny Nadolny and reported by Bharath Vissapragada; the fix is tracked in Apache Kafka JIRA as KAFKA-19012 (GitHub Advisory, oss-security).

Exploitation of this vulnerability has significant confidentiality and integrity consequences: messages intended for one Kafka topic may be silently delivered to a different topic, potentially exposing sensitive data to consumers who are authorized for the destination topic but not the source topic. Consumers on the unintended receiving topic may encounter unexpected or incompatible messages, causing deserialization failures, processing errors, and corrupted downstream data pipelines. Critically, no error is reported to the producer, making the data misrouting difficult to detect without external monitoring. Availability is not directly impacted, but downstream data corruption can cascade across dependent systems (GitHub Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.025% (7th percentile), indicating a low near-term probability of exploitation. The attack complexity is rated High, as triggering the race condition requires specific timing between batch expiration and in-flight network requests (GitHub Advisory, Feedly).

• Logs: Producer application logs showing no errors despite messages not arriving at the intended topic; consumer logs on unexpected topics showing deserialization failures or schema mismatch errors.
• Application Behavior: Messages appearing in Kafka topics they were not intended for, particularly under high-throughput conditions or when delivery.timeout.ms is configured aggressively.
• Monitoring Alerts: Unexpected increases in consumer deserialization error rates on topics that should not be receiving certain message types; producer acknowledgment success combined with consumer-side data anomalies.
• Kafka Metrics: Elevated record-error-rate or record-retry-rate on producers operating near timeout thresholds; unusual cross-topic message volume patterns (GitHub Advisory).

Apache Kafka users should upgrade org.apache.kafka:kafka-clients to one of the patched versions: 3.9.2, 4.0.2, 4.1.2, or 4.2.0 (or later). No configuration-based workaround fully eliminates the race condition, but as an interim measure, increasing delivery.timeout.ms to reduce the likelihood of batch expiration during in-flight requests may lower risk. Additionally, implementing strict topic-level access controls (ACLs) can limit the blast radius if sensitive data is misrouted. IBM has issued advisories for multiple affected products including Business Automation Manager Open Editions, DevOps Solution Workbench, Process Mining, API Connect, Instana Observability, Maximo Application Suite, and Cloudera Data Platform — users of these products should apply the respective IBM security bulletins (GitHub Advisory, IBM Maximo Advisory).

The Apache Kafka community disclosed the vulnerability via the oss-security mailing list on April 7, 2026, crediting Bharath Vissapragada as reporter and Donny Nadolny as both finder and remediation developer (oss-security). Instaclustr published a blog post highlighting the vulnerability as a key lesson for why regular Kafka client upgrades matter. HeroDevs also published a detailed write-up on the buffer pool race condition mechanics. Multiple IBM product teams issued security bulletins acknowledging the impact on their downstream products, reflecting broad ecosystem reach of the vulnerability (Feedly).