CVE Feed

    Dashboard / CVE / CVE-2026-83525

    CVE-2026-83525

    Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.

    Published:Oct 28, 2026
    Last Modified:Nov 6, 2026
    EPS:Oct 28, 2026
    EPSS Score:0.0033
    CVSS Score:6.5

    Affected Products

    Vendor
    Apache
    Product
    Kafka

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114349 (CVSS 6.5) — When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the de…
    CVE-2026-112375 (CVSS 6.5) — An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read …
    CVE-2026-116593 (CVSS 8.1) — Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to v…
    CVE-2026-115644 (CVSS 8.8) — Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.l…
    CVE-2026-111551 (CVSS 7.5) — Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate…
    CVE-2026-111496 (CVSS 9.1) — Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the ne…
    CVE-2026-111115 (CVSS 9.1) — Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the…
    CVE-2026-111108 (CVSS 9.1) — Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared …
    CVE-2026-111073 (CVSS 6.5) — The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload a…
    CVE-2026-110985 (CVSS 9.1) — A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=Default…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High