CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
// AI summary
Apache Kafka versions 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2 allow authenticated clients with CLUSTER_ACTION privilege to crash the KRaft controller via CVE-2026-83525.
// from the source
Posted by Manikumar on Oct 28 Severity: low Affected versions: - Apache Kafka 2.8.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics...