CVE-2026-35554

A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...

CVE-2026-35554

A race condition exists in the Apache Kafka Java producer client buffer pool management. When a production batch expires due to delivery.timeout.ms while a network request is still in flight, its ByteBuffer is prematurely deallocated and returned to the pool. A subsequent batch may reuse this buf...

CVE-2026-35554

A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is...

PT-2026-30827

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 3.9.2 Apache Kafka versions prior to 4.0.2 Apache Kafka versions prior to 4.1.2 Description A race condition in the Java producer client's buffer pool management can lead to messages being silently delivered to...