A race condition in the Apache Kafka Java producer client’s buffer pool causes a produced batch to expire while still travelling on the network. The batch’s ByteBuffer is released prematurely and may be reused for another batch destined for a different topic. The result is that messages are silently delivered to unintended topics, exposing data to unauthorized consumers and corrupting downstream processing. This flaw can lead to significant confidentiality and integrity risks because the producer receives no error notification.

The vulnerability affects Apache Kafka clients from versions up to and including 3.9.1, 4.0.1, and 4.1.1. Users should update to version 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to remediate the flaw.

The CVSS score of 8.7 indicates a high severity attack with potential for major impact. The EPSS score is < 1%, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no public exploits have been reported. The likely attack vector is through any active producer client that can send a high volume of produce requests to a Kafka cluster, attempting to trigger the race condition. Successful exploitation would not require privileged access; it merely needs network connectivity to the producer and Kafka broker, which are common in many deployments.