{"id":"CVE-2026-83525","published":"2026-10-28T17:18:43.983","lastModified":"2026-10-28T20:18:47.467","description":"Incorrect operator (CWE-480) in the FetchSnapshot RPC handler\nin Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2\non all platforms allows an authenticated attacker with\nCLUSTER_ACTION privilege to cause a denial of service\n(controller process termination) via a crafted\nFetchSnapshotRequest with an empty topics array or a topic\nwith no partitions.\n\nUsers are recommended to upgrade to version 4.2.2, 4.3.2, or\n4.4.0, which fix this issue. Users on unsupported branches\n(4.1.x and earlier) should upgrade to 4.2.2 or later.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-480"],"vendors":[],"products":[],"references":[{"url":"https://github.com/apache/kafka/pull/23185","tags":[]},{"url":"https://kafka.apache.org/cve-list","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/7","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/kafka/pull/23185","tags":[]}],"hasPoc":true,"ai":null}