https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33558.htmlhttps://patchthecve.com/cve/CVE-2026-33558.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.3: Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information willhttps://patchthecve.com/cve/CVE-2026-33557.htmlhttps://patchthecve.com/cve/CVE-2026-33557.htmlMon, 26 Oct 2026 22:10:00 +0000CRITICAL 9.1: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience.https://patchthecve.com/cve/CVE-2026-35554.htmlhttps://patchthecve.com/cve/CVE-2026-35554.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.7: A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is pre