org.apache.kafka:kafka-raft vulnerabilities

CVEs whose affected-version data names the org.apache.kafka:kafka-raft package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-83525None

1w ago

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of servi…

▾ SunlitApache Software Foundation · org.apache.kafka:kafka-raftEPSS 0.19%via CVEORG