https://seclists.org/oss-sec/2026/q4/414: CVE-2026-83525: Apache Kafka: Incorct boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed quest.

Q: Which Kafka deployments are exposed?

Kafka deployments using KRaft controllers are exposed if they run Apache Kafka 2.8.0 through versions before 4.2.2, or 4.3.0 through versions before 4.3.2. The issue affects all platforms.

Q: What access does an attacker need?

An attacker must be an authenticated network client with the CLUSTER_ACTION privilege. The vulnerability is triggered by sending a crafted FetchSnapshotRequest.

Q: What is the operational impact of successful exploitation?

Successful exploitation terminates the KRaft controller process, causing a denial of service. The malformed request may contain an empty topics array or a topic with no partitions.

Q: What should teams do if they are on an affected or unsupported release?

Upgrade to Kafka 4.2.2, 4.3.2, or 4.4.0. Users on unsupported 4.1.x and earlier branches should upgrade to 4.2.2 or later.

Published Oct 28, 2026

Updated

Affected Software

1 affected component

Apache Kafka>=2.8.0<4.2.2, >=4.3.0<4.3.2

Frequently Asked Questions

Which Kafka deployments are exposed?

Kafka deployments using KRaft controllers are exposed if they run Apache Kafka 2.8.0 through versions before 4.2.2, or 4.3.0 through versions before 4.3.2. The issue affects all platforms.

What access does an attacker need?

An attacker must be an authenticated network client with the CLUSTER_ACTION privilege. The vulnerability is triggered by sending a crafted FetchSnapshotRequest.

What is the operational impact of successful exploitation?

Successful exploitation terminates the KRaft controller process, causing a denial of service. The malformed request may contain an empty topics array or a topic with no partitions.

What should teams do if they are on an affected or unsupported release?

Upgrade to Kafka 4.2.2, 4.3.2, or 4.4.0. Users on unsupported 4.1.x and earlier branches should upgrade to 4.2.2 or later.

https://seclists.org/oss-sec/2026/q4/414: CVE-2026-83525: Apache Kafka: Incorct boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed quest.

Affected Software

Frequently Asked Questions

Which Kafka deployments are exposed?

What access does an attacker need?

What is the operational impact of successful exploitation?

What should teams do if they are on an affected or unsupported release?

Company

Resources

Contact

Frequently Asked Questions

Which Kafka deployments are exposed?

What access does an attacker need?

What is the operational impact of successful exploitation?

What should teams do if they are on an affected or unsupported release?