Apache Kafka Clients up to 3.9.1/4.0.1/4.1.1 Producer Message use after free

Summaryinfo

A vulnerability was found in Apache Kafka Clients up to 3.9.1/4.0.1/4.1.1. It has been classified as critical. Impacted is an unknown function of the component Producer Message Handler. The manipulation leads to use after free. This vulnerability is referenced as CVE-2026-35554. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache Kafka Clients up to 3.9.1/4.0.1/4.1.1. This issue affects an unknown code block of the component Producer Message Handler. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer. Data Confidentiality: Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic. Data Integrity: Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data. This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and  ≤ 4.1.1. Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.

The advisory is shared at issues.apache.org. The identification of this vulnerability is CVE-2026-35554 since 04/03/2026. The exploitation is known to be difficult. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/07/2026).

Upgrading to version 3.9.2, 4.0.2, 4.1.2 or 4.2.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Apache

Name

• Kafka Clients

Version

• 3.9.0
• 3.9.1
• 4.0.0
• 4.0.1
• 4.1.0
• 4.1.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion