Search: CVE-2026-35554

CVE-2026-35554 is a high-severity use-after-free vulnerability in Apache Kafka Java producer clients up to versions 3.9.1, 4.0.1, and 4.1.1. It arises from a race condition in buffer pool management where expired produce batches can have their buffers prematurely deallocated and reused, causing message corruption. This can lead to messages being silently delivered to incorrect topics without error notification. The vulnerability impacts data confidentiality by potentially exposing messages to unintended consumers and data integrity by causing deserialization failures and corrupted downstream data.