---
id: "CVE-2026-83525"
kind: "vulnerability"
aliases: ["CVE-2026-83525"]
title: "Apache Kafka: crafted FetchSnapshot request crashes the controller process"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-kafka", "controller", "kafka-kraft", "package", "self-hosted"]
not_affected_if: ["already-on-4.2.2-or-later", "no-untrusted-cluster-action-principals"]
published_at: "2026-10-28T17:18:43+00:00"
first_seen_at: "2026-10-28T17:34:10+00:00"
updated_at: "2026-10-28T17:36:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83525", "first_seen_at": "2026-10-28T17:34:10+00:00"}]
---

# Apache Kafka: crafted FetchSnapshot request crashes the controller process

A crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions makes the Kafka controller process terminate. The attacker must already hold CLUSTER_ACTION privilege.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Kafka broker version with `kafka-broker-api-versions.sh --bootstrap-server <host>:9092` or the installed package version
- Confirm whether the cluster runs in KRaft mode with controllers that accept FetchSnapshot requests from clients with CLUSTER_ACTION ACLs

## Fix

- Upgrade Apache Kafka to `4.2.2`, `4.3.2`, or `4.4.0`
- Users on 4.1.x or earlier should move to `4.2.2` or later

## Timeline

- 2026-10-28T17:34:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83525

## From the sources

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler
in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2
on all platforms allows an authenticated attacker with
CLUSTER_ACTION privilege to cause a denial of service
(controller process termination) via a crafted
FetchSnapshotRequest with an empty topics array or a topic
with no partitions.

Users are recommended to upgrade to version 4.2.2, 4.3.2, or
4.4.0, which fix this issue. Users on unsupported branches
(4.1.x and earlier) should upgrade to 4.2.2 or later.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_