Denial of Service Vulnerability in Apache Kafka by Apache

CVE-2026-83525

What is CVE-2026-83525?

An incorrect operator in the FetchSnapshot RPC handler in Apache Kafka may allow an authenticated attacker holding the CLUSTER_ACTION privilege to exploit the vulnerability. By sending a specially crafted FetchSnapshotRequest that includes either an empty topics array or a topic without any partitions, the attacker can terminate the controller process, leading to service disruptions. To mitigate this risk, users should upgrade to versions 4.2.2, 4.3.2, or 4.4.0. Those still using earlier unsupported branches should transition to 4.2.2 or newer to ensure system integrity.

References