{"id":"CVE-2026-83525","title":"Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.","summary":"Incorrect operator (CWE-480) in the FetchSnapshot RPC handler\nin Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2\non all platforms allows an authenticated attacker with\nCLUSTER_ACTION privilege to cause a denial of servi…","severity":"none","cwe":["CWE-480"],"vendor":"Apache Software Foundation","product":"org.apache.kafka:kafka-raft","affected":["org.apache.kafka:kafka-raft >= 2.8.0 < 4.2.2","org.apache.kafka:kafka-raft >= 4.3.0 < 4.3.2"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T20:07:03.066Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-83525","references":[{"url":"https://github.com/apache/kafka/pull/23185"},{"url":"https://kafka.apache.org/cve-list"}],"tags":["cve.org"],"epss":0.00186,"epssPercentile":0.08202,"ingestedAt":"2026-10-28T17:14:44.467Z","slug":"CVE-2026-83525","body":"## Overview\n\nIncorrect operator (CWE-480) in the FetchSnapshot RPC handler\nin Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2\non all platforms allows an authenticated attacker with\nCLUSTER_ACTION privilege to cause a denial of service\n(controller process termination) via a crafted\nFetchSnapshotRequest with an empty topics array or a topic\nwith no partitions.\n\nUsers are recommended to upgrade to version 4.2.2, 4.3.2, or\n4.4.0, which fix this issue. Users on unsupported branches\n(4.1.x and earlier) should upgrade to 4.2.2 or later.\n\n## Affected\n\n- `org.apache.kafka:kafka-raft >= 2.8.0 < 4.2.2`\n- `org.apache.kafka:kafka-raft >= 4.3.0 < 4.3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}