Kafka FetchSnapshot bug lets privileged clients crash KRaft (CVE-2026-83525)
Authenticated clients with CLUSTER_ACTION can terminate the controller using an empty-topics FetchSnapshotRequest.
36
Vulnerability1 · 1 read
CVE-2026-83525
Incorrect operator DoS in Apache Kafka FetchSnapshot
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An incorrect operator in Apache Kafka’s FetchSnapshot RPC handler can terminate the KRaft controller. An authenticated network client that already holds the CLUSTER_ACTION privilege triggers it by sending a FetchSnapshotRequest with an empty topics array or a topic that has no partitions. Affected installs are Kafka 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2 on all platforms; the crash is a denial of service.
What to do: Upgrade to 4.2.2, 4.3.2, or 4.4.0. Users on unsupported 4.1.x and earlier should upgrade to 4.2.2 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Kafka | 2.8.0 before 4.2.2, and 4.3.0 before 4.3.2 | 4.2.2, 4.3.2, or 4.4.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.
- Weakness
- CWE-480