{"id":"CVE-2026-83525","kind":"vulnerability","aliases":["CVE-2026-83525"],"related":[],"title":"Apache Kafka: crafted FetchSnapshot request crashes the controller process","description":"Incorrect operator (CWE-480) in the FetchSnapshot RPC handler\nin Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2\non all platforms allows an authenticated attacker with\nCLUSTER_ACTION privilege to cause a denial of service\n(controller process termination) via a crafted\nFetchSnapshotRequest with an empty topics array or a topic\nwith no partitions.\n\nUsers are recommended to upgrade to version 4.2.2, 4.3.2, or\n4.4.0, which fix this issue. Users on unsupported branches\n(4.1.x and earlier) should upgrade to 4.2.2 or later.","summary":"A crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions makes the Kafka controller process terminate. The attacker must already hold CLUSTER_ACTION privilege.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-kafka","controller","kafka-kraft","package","self-hosted"],"not_affected_if":["already-on-4.2.2-or-later","no-untrusted-cluster-action-principals"],"how_to_check":"- Check the Kafka broker version with `kafka-broker-api-versions.sh --bootstrap-server <host>:9092` or the installed package version\n- Confirm whether the cluster runs in KRaft mode with controllers that accept FetchSnapshot requests from clients with CLUSTER_ACTION ACLs","fix":"- Upgrade Apache Kafka to `4.2.2`, `4.3.2`, or `4.4.0`\n- Users on 4.1.x or earlier should move to `4.2.2` or later","status":"open","published_at":"2026-10-28T17:18:43+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:28+00:00","updated_at":"2026-10-28T17:36:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T17:36:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kafka to `4.2.2`, `4.3.2`, or `4.4.0`\n- Users on 4.1.x or earlier should move to `4.2.2` or later","reach":"network","title":"Apache Kafka: crafted FetchSnapshot request crashes the controller process","impact":"medium","summary":"A crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions makes the Kafka controller process terminate. The attacker must already hold CLUSTER_ACTION privilege.","category":"package","nicknames":[],"who_cares":["apache-kafka","kafka-kraft","self-hosted","controller"],"confidence":0.8,"needs_auth":"yes","worst_case":"Controller process terminates, causing cluster denial of service","analyst_note":"","how_to_check":"- Check the Kafka broker version with `kafka-broker-api-versions.sh --bootstrap-server <host>:9092` or the installed package version\n- Confirm whether the cluster runs in KRaft mode with controllers that accept FetchSnapshot requests from clients with CLUSTER_ACTION ACLs","needs_analyst":false,"not_affected_if":["already-on-4.2.2-or-later","no-untrusted-cluster-action-principals"],"who_is_affected":"Clusters running Apache Kafka 2.8.0 up to but not including 4.2.2, or 4.3.0 up to but not including 4.3.2, on any platform. The exposure is limited to principals that already hold CLUSTER_ACTION privilege, normally broker or controller identities, so teams with no such principals outside the cluster can deprioritize it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3461,"output_tokens":613,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-480':58C '-83525':12A,15A '2.8.0':68C '4.1':130C '4.2.2':70C,118C,137C '4.3.0':73C '4.3.2':75C,119C '4.4.0':121C 'action':53B,85C 'allow':79C 'alreadi':50B 'apach':1A,17B,65C 'apache-kafka':16B 'array':34B,104C 'attack':48B,82C 'authent':81C 'branch':129C 'caus':88C 'cluster':52B,84C 'control':8A,19B,44B,93C 'craft':3A,28B,98C 'crash':6A 'cve':10A,13A 'cwe':57C 'denial':90C 'earlier':133C 'empti':32B,102C 'fetchsnapshot':4A,61C 'fetchsnapshotrequest':29B,99C 'fix':123C 'handler':63C 'hold':51B 'host':26B 'incorrect':55C 'issu':125C 'kafka':2A,18B,21B,43B,66C 'kafka-kraft':20B 'kraft':22B 'later':139C 'make':41B 'must':49B 'oper':56C 'packag':23B 'partit':40B,110C 'platform':78C 'privileg':54B,86C 'process':9A,45B,94C 'recommend':113C 'request':5A 'rpc':62C 'self':25B 'self-host':24B 'servic':92C 'termin':46B,95C 'topic':33B,37B,103C,107C 'unsupport':128C 'upgrad':115C,135C 'user':111C,126C 'version':117C 'via':96C 'x':131C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Apache Kafka 2.8.0 up to but not including 4.2.2, or 4.3.0 up to but not including 4.3.2, on any platform. The exposure is limited to principals that already hold CLUSTER_ACTION privilege, normally broker or controller identities, so teams with no such principals outside the cluster can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83525","severity":null,"published_at":"2026-10-28T17:18:43+00:00","modified_at":"2026-10-28T17:18:43+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}