CVE-2026-83525

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 28, 2026
Reserved: Aug 31, 2026

Read the record on cve.org

Description

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions.

Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.

Scores

The record has no CVSS score.

Weaknesses

CWE-480 Use of incorrect operator

Affected Products

Product	Versions
Apache KafkaApache Software Foundation	2.8.0 to before 4.2.2Affected 4.3.0 to before 4.3.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.