Live › vulnerability › CVE-2026-83525
Go to dashboardA crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions makes the Kafka controller process terminate. The attacker must already hold CLUSTER_ACTION privilege.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Clusters running Apache Kafka 2.8.0 up to but not including 4.2.2, or 4.3.0 up to but not including 4.3.2, on any platform. The exposure is limited to principals that already hold CLUSTER_ACTION privilege, normally broker or controller identities, so teams with no such principals outside the cluster can deprioritize it.
No product ranges from the sources yet.
kafka-broker-api-versions.sh --bootstrap-server <host>:9092 or the installed package version4.2.2, 4.3.2, or 4.4.04.2.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions.
Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.
This page as .md · .json · in your agent: get_signal("CVE-2026-83525")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.