Threat Intelligence Database

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.

CVE-2026-35554 is a high-severity use-after-free vulnerability in Apache Kafka Java producer clients up to versions 3.9.1, 4.0.1, and 4.1.1. It arises from a race condition in buffer pool management where expired produce batches can have their buffers prematurely deallocated and reused, causing message corruption. This can lead to messages being silently delivered to incorrect topics without error notification. The vulnerability impacts data confidentiality by potentially exposing messages to unintended consumers and data integrity by causing deserialization failures and corrupted downstream data.