CVE-2026-83525

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions.

Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-480

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache Kafka	>= 2.8.0, < 4.2.2; >= 4.3.0, < 4.3.2

References

Timeline

Published: Oct 28, 2026
Last modified: Nov 5, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-835268.8The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimety CVE-2026-835278.1An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain admini CVE-2026-835284.9Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privilege CVE-2026-83534.8Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScr CVE-2026-835304.3A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and CVE-2026-835318.8Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statem CVE-2026-835326.8The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them CVE-2026-835335.3The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an or CVE-2026-835346.4PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run ar CVE-2026-835357.4A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer S CVE-2026-835365.3A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such CVE-2026-835375.3The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an or