Intel

CVE-2026-35554

Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update

highEPSS 0.4%

Description

A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer deallocation and potential reuse by other messages. Consequently, sensitive data may be exposed to unauthorized consumers, and data integrity can be compromised through deserialization failures and processing errors.

Source: BSI_CSAFBSIREDHAT_CSAFBSIBSI_CSAFNVDCVEORGCVELISTV5BSIBSI_CSAFOSV

Metrics

Severity
high
Priority score
137.09
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
8.7
Source: cna-v3
CVSS v3
8.7
CVSS v4
—
EPSS percentile
36.9 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-12 19:35 UTC
CWE
CWE-416, CWE-362

Weakness classes (CWE)

  • CWE-416Variant

    Use After Free

    The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

    cwe.mitre.org →

  • CWE-362Class

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-08-17 18:05 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* versions from (including) 4.1.0 up to (excluding) 4.1.2 *cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* versions from (including) 2.8.0 up to (excluding) 3.9.2 *cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.0.2
    • Reference Type: Apache Software Foundation: https://issues.apache.org/jira/browse/KAFKA-19012 Types: Issue Tracking
    • Reference Type: Apache Software Foundation: https://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6 Types: Vendor Advisory
    • Reference Type: CVE: http://www.openwall.com/lists/oss-security/2026/04/07/6 Types: Mailing List, Third Party Advisory

Affected operating systems

  • linux

    ubuntu / nettynoble

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apache

    kafka2.8.0 – 3.9.2

  • apache

    kafka4.0.0 – 4.0.2

  • apache

    kafka4.1.0 – 4.1.2

  • Atlassian

    BambooData Center LTS 10.2.22

  • Atlassian

    BambooData Center LTS 12.1.10

  • Atlassian

    BitbucketData Center 10.4.2

  • Atlassian

    BitbucketData Center LTS 10.2.6

  • Atlassian

    BitbucketData Center LTS 9.4.23

  • Atlassian

    ConfluenceData Center LTS 10.2.15

  • Atlassian

    ConfluenceData Center LTS 9.2.23

  • Atlassian

    Crucible4.9.13

  • Atlassian

    Fisheye4.9.13

  • Atlassian

    JiraData Center LTS 10.3.24

  • Atlassian

    JiraData Center LTS 11.3.10

  • bitnami

    golang1.26.0-0

  • eclipse

    vert.x4.0.0 – 4.5.29

  • eclipse

    vert.x5.0.0 – 5.1.4

  • go

    stdlib1.26.0-0

  • golang

    go1.26.0 – 1.26.2

  • golang

    go1.26.0 – 1.26.3

  • golang

    go1.25.10

  • golang

    go1.25.9

  • golang

    net0.55.0

  • IBM

    QRadar SIEM<7.5.0 UP15 IF06

References & sources

Linked CVEs

Show 33 more CVEs
IDCVE-2026-35554