CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-83525

Apache Kafka versions 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2 are vulnerable to a denial of service (controller process termination) due to an incorrect operator (CWE-480) in the FetchSnapshot RPC handler. An authenticated attacker with CLUSTER_ACTION privileges can trigger this by sending a cr...

CVE-2026-83525 Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...