CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

As cited

Copy frozen at 2026-10-28 21:26 UTC (site build).

vulnerabilities

CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Apache Kafka versions 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2 contain an incorrect boolean operator (CWE-480) in the FetchSnapshot remote procedure call handler. An authenticated attacker with CLUSTER_ACTION privilege can exploit this flaw by sending a malformed FetchSnapshotRequest with empty topics to crash the KRaft controller process.

Why it matters: Kafka cluster administrators running affected versions need to patch immediately, as any authenticated user with cluster permissions can trigger a denial of service that terminates the controller.

Source published

2026-10-28 17:23 UTC

First seen by Cybersecurity Tracker

2026-10-28 20:02 UTC