Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7 XP 6.0.5.GA release

CVE-2026-35554 is a vulnerability in Apache Kafka Clients integrated into Red Hat JBoss Enterprise Application Platform 8.1.7 XP 6.0.5.GA. It results from a race condition in the producer buffer management, leading to potential information disclosure and data corruption. Red Hat issued a cumulative patch release (JBoss EAP XP 6.0.5) that includes a fix for this issue. The advisory recommends applying this update following standard backup and update procedures. No CVSS score is provided in the advisory.

The vulnerability can cause information disclosure and data corruption within Apache Kafka Clients used by the affected JBoss EAP runtime. This could affect the confidentiality and integrity of data processed by Kafka producers in the platform. The severity is assessed as moderate by Red Hat.

A cumulative patch release (JBoss EAP XP 6.0.5.GA) is available that addresses this vulnerability. Users should apply this update after ensuring all previously released errata relevant to their system have been installed and after backing up their existing installation, including applications, configuration files, and databases. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance.