Loading story…
Apache disclosed CVE-2026-35554, a moderate-severity flaw in the Apache Kafka Java producer client that can silently corrupt message buffers and send records to the wrong Kafka topics. The bug stems from a race condition in buffer pool management: when a produce batch expires because of delivery.timeout.ms while its network request is still in flight, the batch’s ByteBuffer can be returned to the pool too early and reused by another batch before the original request completes.
If the reused buffer is overwritten, the original in-flight request may transmit corrupted data to unintended topics without reporting an error to the producer. Apache said the issue creates confidentiality risk by exposing messages to unauthorized topic consumers and integrity risk through deserialization failures, processing errors, and downstream data corruption. Affected versions include kafka-clients 2.8.0 through 3.9.1, 4.0.0 through 4.0.1, and 4.1.0 through 4.1.1; users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache recommended that users upgrade affected Kafka client deployments to versions 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to remediate CVE-2026-35554. The fix addresses the buffer pool race condition that could silently misroute or corrupt producer messages.
Apache disclosed CVE-2026-35554, a moderate-severity race condition in Apache Kafka Java producer clients that can corrupt message buffers and cause messages to be delivered to the wrong topics. The flaw affects kafka-clients versions 2.8.0 through 3.9.1, 4.0.0 through 4.0.1, and 4.1.0 through 4.1.1, creating confidentiality and integrity risks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed two vulnerabilities affecting multiple **ActiveMQ** components, including Client, Broker, and bundled distributions. **CVE-2026-33227** is a low-severity pathname restriction flaw that lets an authenticated user manipulate a supplied `key` value to traverse the classpath in two cases: when creating a **STOMP** consumer and when browsing messages through the web console. Apache warned the issue could expose classpath resource loading and potentially be chained with another attack. The flaw affects the 5.x branch before **5.19.3** and the 6.x branch from **6.0.0** before **6.2.2**, but Apache said those initial fixes were incomplete on Windows because of path separator handling, and recommended upgrading instead to **5.19.4** or **6.2.3**. Apache also published **CVE-2026-39304**, an important denial-of-service flaw in ActiveMQ's **NIO SSL transports** caused by incorrect handling of **TLS 1.3 `KeyUpdate`** messages. A client can repeatedly trigger updates and exhaust broker memory in the SSL engine, causing out-of-memory crashes and service disruption. Apache added that related handshake handling is also broken for earlier TLS versions such as **TLS 1.2**, though those cases lead to hung connections rather than memory exhaustion. The DoS issue affects the 5.x branch before **5.19.4** and the 6.x branch from **6.0.0** before **6.2.4**; users are advised to upgrade to **5.19.5** or **6.2.4**.
Jun 29, 2026
Spring disclosed two high-severity unsafe deserialization vulnerabilities affecting widely used messaging components: `CVE-2026-41731` in **Spring for Apache Kafka** and `CVE-2026-41855` in the **Spring Framework**. The Kafka issue stems from overly broad trusted-package matching in `JsonKafkaHeaderMapper` and the deprecated `DefaultKafkaHeaderMapper`, where prefix-based checks caused trust in a package to extend to all subpackages. Spring said a malicious producer could abuse crafted Kafka header values together with Jackson's default bean deserialization to make consumers instantiate arbitrary JDK classes, and assigned the flaw `CWE-502` with a `CVSS:3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The related Spring Framework flaw affects Jackson-based JMS message converters in untrusted JMS environments, where deserialization of gadget classes can enable arbitrary class instantiation and unauthorized actions. Affected Kafka versions include `4.0.0`-`4.0.5`, `3.3.0`-`3.3.15`, `3.2.0`-`3.2.13`, `2.9.0`-`2.9.13`, and `2.8.0`-`2.8.11`, while Spring recommended upgrading Kafka deployments to fixed releases such as `4.0.6` and `3.3.16`, with commercial fixes for other branches. The JMS converter issue impacts Spring Framework `7.0.0`-`7.0.7`, `6.2.0`-`6.2.18`, `6.1.0`-`6.1.27`, and `5.3.0`-`5.3.48`, extending the exposure across multiple supported and legacy release lines.
Jun 29, 2026
Apache CXF disclosed **CVE-2026-57818**, a low-severity flaw in the OAuth2 component `org.apache.cxf:cxf-rt-rs-security-oauth2` that can let a single authorization code be redeemed multiple times. The issue stems from a time-of-check/time-of-use race condition in `JCacheCodeDataProvider`, allowing concurrent requests to obtain multiple distinct valid access tokens from one OAuth2 authorization code. The vulnerability affects Apache CXF **4.2.0 before 4.2.3**, **4.0.0 before 4.1.8**, and **3.6.x before 3.6.12**. Apache advised users to upgrade to **4.2.3**, **4.1.8**, or **3.6.12** to remediate the issue, and credited **Guanping Zhang** with reporting the bug.
Aug 6, 2026