Read the docs
TI-2026-27662 Aliases CVE-2026-35554GHSA-5qcv-4rpc-jp93

Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

Priority LOW 38CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 5 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer. Data Confidentiality: Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic. Data Integrity: Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data. This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and  ≤ 4.1.1. Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00454 39th percentileScored 2026-11-08
Fix Partial org.apache.kafka:kafka-clients (Maven): 3.9.2, 4.0.2, 4.1.2Red Hat: 5 advisoriesRed Hat: 5 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Kafka Clients2.8.0 – 3.9.1; 4.0.0 – 4.0.1; 4.1.0 – 4.1.1—No fix listedCNA
—org.apache.kafka:kafka-clients (Maven)2.8.0 to before 3.9.23.9.2Patch availableGHSA-5qcv-4rpc-jp93
—org.apache.kafka:kafka-clients (Maven)4.0.0 to before 4.0.24.0.2Patch availableGHSA-5qcv-4rpc-jp93
—org.apache.kafka:kafka-clients (Maven)4.1.0 to before 4.1.24.1.2Patch availableGHSA-5qcv-4rpc-jp93
  • Apache Kafka Clients VendorApache Affected 2.8.0 – 3.9.1; 4.0.0 – 4.0.1; 4.1.0 – 4.1.1 Fixed in — No fix listed CNA
  • org.apache.kafka:kafka-clients (Maven) Vendor— Affected 2.8.0 to before 3.9.2 Fixed in 3.9.2 Patch available GHSA-5qcv-4rpc-jp93
  • org.apache.kafka:kafka-clients (Maven) Vendor— Affected 4.0.0 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-5qcv-4rpc-jp93
  • org.apache.kafka:kafka-clients (Maven) Vendor— Affected 4.1.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-5qcv-4rpc-jp93

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*2.8.0 to before 3.9.2; 4.0.0 to before 4.0.2; 4.1.0 to before 4.1.2VulnerableApache
  • cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* Versions 2.8.0 to before 3.9.2; 4.0.0 to before 4.0.2; 4.1.0 to before 4.1.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-5qcv-4rpc-jp93 org.apache.kafka:kafka-clients (Maven) Fixed in 3.9.2 Advisory →
  • Fix · GHSA-5qcv-4rpc-jp93 org.apache.kafka:kafka-clients (Maven) Fixed in 4.0.2 Advisory →
  • Fix · GHSA-5qcv-4rpc-jp93 org.apache.kafka:kafka-clients (Maven) Fixed in 4.1.2 Advisory →

Red Hat 5 advisories

  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:42098 Released 2026-07-20 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.1.7 XP 6.0.5.GA release
    • Red Hat JBoss Enterprise Application Platform 6.0.5.GA org.apache.kafka.kafka-clients-3.9.2.redhat-00001-test.jar
  • RHSA-2026:17668 Released 2026-05-14 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Show 2 more Red Hat advisories
  • RHSA-2026:13631 Released 2026-05-05 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP1)
    • Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
  • RHSA-2026:11721 Released 2026-05-05 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.3.SP1 security update
    • Red Hat build of Quarkus 3.27.3.SP1 io.quarkus.quarkus-vertx-http-3.27.3.redhat-00002.jar, org.apache.kafka.kafka-clients-4.0.2.redhat-00001.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Out of support scope
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
streams for Apache Kafka 2AffectedNo fix planned: Out of support scope
Red Hat Build of Apache Camel 4.14 for Quarkus 3.27Fixed RHSA-2026:13631
Red Hat JBoss Enterprise Application Platform 6.0.5.GAFixed RHSA-2026:42098
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14Fixed RHSA-2026:17668
Red Hat build of Quarkus 3.27.3.SP1Fixed RHSA-2026:11721
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
Not affected: 6 products
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 6.0.5.GA
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat build of Quarkus 3.27.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35554
  2. 2026-10-03 Alias added: GHSA-5qcv-4rpc-jp93
  3. 2026-10-09 Fix available: RHSA-2026:13631 · Red Hat
  4. 2026-10-10 Fix available: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · Red Hat
  5. 2026-10-19 EPSS moved to the 50th–90th percentile
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 3

Other 8

  • TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
  • TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
  • TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
  • TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
  • TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences