Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- The rating the maker of the software gives it. Shown when it differs from the CVSS level.What do these mean? →
- Low (apache)
- Fix
- Fixed in 4.2.2, 4.3.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Kafka, specifically its KRaft controller's FetchSnapshot RPC handler, is affected. An authenticated client holding the CLUSTER_ACTION privilege can send a specially crafted request that causes the controller process to terminate, resulting in a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- org.apache.kafka:kafka-raft
From 2.8.0 · fixed in 4.2.2; From 4.3.0 · fixed in 4.3.2