A race condition in the Apache Kafka Java producer client’s buffer pool management causes a use-after-free scenario when a produce batch expires due to delivery.timeout.ms while its network request is still in flight. The batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent batch reuses this freed buffer before the original request completes, buffer contents may become corrupted, resulting in messages being delivered to incorrect topics without error reporting. This affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and ≤ 4.1.1. The vulnerability impacts confidentiality and integrity of message delivery. Upgrading to versions 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later addresses the issue.

Messages may be delivered to unintended topics, potentially exposing sensitive data to unauthorized consumers. Consumers of the incorrect topic may experience deserialization failures, processing errors, and corrupted downstream data. The vulnerability compromises both data confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Users should upgrade Apache Kafka clients to versions 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to remediate this vulnerability. No other mitigation or temporary workaround is documented. Patch status is confirmed by the vendor advisory recommending these fixed versions.