CLEANSTART-2026-YX54699 race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

🗓️ 25 Apr 2026 00:46:03Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Multiple vulnerabilities affect strimzi-kafka-operator; a race in Kafka producer buffer pool may deliver messages to wrong topics.

Reporter	Title	Published	Views	Family All 673
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.129.Final.jar	28 Apr 202622:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services for June 2026- Multiple CVEs addressed	14 Jul 202606:59	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:17	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Apache Kafka affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-35554, CVE-2026-33558)	27 Jul 202622:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library.(CVE-2026-33870).	3 Aug 202608:58	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the HDFS layer are now addressed in 5.2.3.8 or higher and 6.0.1.1 or higher	13 Aug 202616:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	15 Apr 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for April 2026	30 Apr 202611:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-server (CVE-2026-1605)	4 May 202616:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses kafka-clients-3.9.1.jar which is vulnerable to CVE-2026-35554	29 May 202607:47	–	ibm

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YX54699.json
osv	www.osv.dev/vulnerability/CVE-2025-11143
osv	www.osv.dev/vulnerability/CVE-2026-1605
osv	www.osv.dev/vulnerability/CVE-2026-33870
osv	www.osv.dev/vulnerability/CVE-2026-33871
osv	www.osv.dev/vulnerability/CVE-2026-35554
osv	www.osv.dev/vulnerability/ghsa-72hv-8253-57qq
osv	www.osv.dev/vulnerability/ghsa-cphf-4846-3xx9
osv	www.osv.dev/vulnerability/ghsa-pwqr-wmgm-9rr8
osv	www.osv.dev/vulnerability/ghsa-w9fj-cfpg-grvv

27 Jun 2026 01:15Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.8

EPSS0.01125