CVE-2026-83525

Overview

Apache Kafka is an open-source distributed event streaming platform used for high-throughput, fault-tolerant data pipelines and stream processing. It stores records in partitioned, replicated, append-only logs on a cluster of brokers, and exposes producer, consumer, admin, Streams, and Connect APIs for publishing, subscribing to, and processing those records. The Java client and server components are published as Maven artifacts under org.apache.kafka.

A denial of service vulnerability (CVE-2026-83525) has been identified in the KRaft FetchSnapshot RPC handler of Apache Kafka, which allows an authenticated attacker with the CLUSTER_ACTION privilege to terminate the controller process by sending a crafted FetchSnapshot request with an empty topics array or a topic with no partitions.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache Kafka.

‍

Details

Module Info

• Product: Apache Kafka
• Affected packages: org.apache.kafka:kafka-raft
• Affected versions: >=2.8.0 <4.2.2, >=4.3.0 <4.3.2
• GitHub repository: https://github.com/apache/kafka
• Published packages: https://central.sonatype.com/artifact/org.apache.kafka/kafka-raft
• Package manager: Gradle
• Fixed in:
  • OSS Apache Kafka 4.2.2, 4.3.2, 4.4.0
  • NES for Apache Kafka

Vulnerability Info

This Low-severity vulnerability is found in the org.apache.kafka:kafka-raft package in multiple versions of Apache Kafka. The KRaft client (KafkaRaftClient) expects every FetchSnapshot request and response to carry exactly one topic with exactly one partition, and both handlers try to reject anything else with the same check:

if (data.topics().size() != 1 && data.topics().get(0).partitions().size() != 1) {
    return FetchSnapshotResponse.withTopLevelError(Errors.INVALID_REQUEST);
}

Because the two conditions are joined with && instead of ||, the check fails on exactly the malformed requests it is meant to reject. When the topics array is empty, data.topics().size() != 1 is true, so the second operand runs and data.topics().get(0) throws an IndexOutOfBoundsException on the empty list. When the request carries one topic with no partitions, the first operand is false, the check short-circuits and the malformed request is accepted. handleFetchSnapshotRequest then fails to find the metadata partition and builds its error response from data.topics().get(0).partitions().get(0), which throws on the empty partition list.

handleFetchSnapshotRequest runs synchronously on the KRaft polling thread, so the exception is not turned into an error response. It escapes the request handler, and per the advisory the controller process terminates. handleFetchSnapshotResponse uses the identical check on responses received from the leader.

‍

Mitigation

Only recent versions of Apache Kafka are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. The Apache Kafka project does bugfix releases only for the last three minor releases; see the project's time-based release plan.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Kafka to a currently supported release that contains the fix, such as 4.2.2.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Mike Read (finder)