CVE-2026-83525

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 2.8.0 through 4.2.1 Apache Kafka versions 4.3.0 through 4.3.1

Description An incorrect operator in the FetchSnapshot RPC handler allows an authenticated attacker with CLUSTER ACTION privilege to cause a denial of service, resulting in the termination of the controller process. This is achieved by sending a crafted FetchSnapshotRequest containing an empty topics array or a topic that has no partitions.

Recommendations Upgrade Apache Kafka versions 2.8.0 through 4.2.1 to version 4.2.2 or later. Upgrade Apache Kafka versions 4.3.0 through 4.3.1 to version 4.3.2.