{"schema":"threatline.record/2","record":{"id":"CVE-2026-83525","aliases":[],"summary":"Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.","details":"Incorrect operator (CWE-480) in the FetchSnapshot RPC handler\nin Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2\non all platforms allows an authenticated attacker with\nCLUSTER_ACTION privilege to cause a denial of service\n(controller process termination) via a crafted\nFetchSnapshotRequest with an empty topics array or a topic\nwith no partitions.\n\nUsers are recommended to upgrade to version 4.2.2, 4.3.2, or\n4.4.0, which fix this issue. Users on unsupported branches\n(4.1.x and earlier) should upgrade to 4.2.2 or later.","categories":["Unclassified"],"product":"Apache Kafka","vendor":"Apache Software Foundation","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-83525","source_modified_at":"2026-10-28T20:07:03.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Apache Kafka","vendor":"Apache Software Foundation","versions":[{"status":"affected","version":"2.8.0","lessThan":"4.2.2","versionType":"semver"},{"status":"affected","version":"4.3.0","lessThan":"4.3.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-83525","source_modified_at":"2026-10-28T20:07:03.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Apache Kafka","ecosystem":null},"version":"4.2.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-83525","source_modified_at":"2026-10-28T20:07:03.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Apache Kafka","ecosystem":null},"version":"4.3.2","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T16:37:19.893Z","modified_at":"2026-10-28T20:07:03.066Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-83525","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:07:03.066Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/apache/kafka/pull/23185","tags":["patch"]},{"source":"CVE List","url":"https://kafka.apache.org/cve-list","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T20:07:03.066Z","content_hash":"e4ae723e40112267c362796e3b357b9c384a1a53db4d93ac461887ca04ed10cb"}}