CVE-2026-35554

OVERVIEW CVE-2026-35554 is a race condition vulnerability in Apache Kafka's Java producer client buffer pool management that causes messages to be silently delivered to incorrect topics. The flaw occurs when a produce batch expires while its network request remains in flight, causing premature buffer deallocation. Subsequent producer batches can reuse the freed buffer before the original request completes, resulting in corrupted message delivery to unintended topics. The vulnerability affects Kafka versions 3.9.1 and earlier, 4.0.1 and earlier, and 4.1.1 and earlier, requiring upgrades to versions 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later. SEVERITY The vulnerability carries a CVSS 3.1 score of 8.7 (HIGH) with a network attack vector, high complexity, and no authentication requirement. The impact is significant across confidentiality and integrity dimensions: sensitive messages intended for one topic may be exposed to consumers of unintended topics, and recipients may encounter deserialization failures or corrupted downstream data. The remote exploitability combined with cross-scope impact elevates concern despite the relatively high attack complexity requirement. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation indicators. The EPSS score of 0.000370 indicates extremely low exploitation probability relative to other CVEs, suggesting minimal real-world attacker interest at present. Community attention remains low, with no publicly available proof-of-concept code reported, allowing organizations a reasonable window for timely patching before widespread awareness increases exploitation likelihood.