CVE-2026-83525
Received
Received - Intake
Denial of Service in Apache Kafka via FetchSnapshotRequest
Vulnerability report for CVE-2026-83525, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: Apache Software Foundation
Description
Description
Incorrect operator (CWE-480) in the FetchSnapshot RPC handler
in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2
on all platforms allows an authenticated attacker with
CLUSTER_ACTION privilege to cause a denial of service
(controller process termination) via a crafted
FetchSnapshotRequest with an empty topics array or a topic
with no partitions.
Users are recommended to upgrade to version 4.2.2, 4.3.2, or
4.4.0, which fix this issue. Users on unsupported branches
(4.1.x and earlier) should upgrade to 4.2.2 or later.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Apache Software Foundation | Apache Kafka | 2.8.0 |
| Apache Software Foundation | Apache Kafka | 4.3.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-480 | The product accidentally uses the wrong operator, which changes the logic in security-relevant ways. |
