CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-83525

Apache Kafka versions 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2 are vulnerable to a denial of service (controller process termination) due to an incorrect operator (CWE-480) in the FetchSnapshot RPC handler. An authenticated attacker with CLUSTER_ACTION privileges can trigger this by sending a cr...

EUVD-2026-112210

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

PT-2026-128336

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER ACTION privilege to cause a denial of service controller process termination via a crafted...