THREAT OPS › Threat News › [NVD] CVE-2026-35554 (HIGH 8.7) — A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.
When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch
[NVD] CVE-2026-35554 (HIGH 8.7) — A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch
CVE-2026-35554 CVSS: 8.7 HIGH Published: 2026-04-07T14:16:23.413
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.
When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned
Indicators of compromise
- CVE-2026-35554cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-35554