CVE and update status of the FreeBSD ports tree3,534 unaddressed CVEs in 701 portsAll times are CET
CVE details

CVE-2026-83525

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.

Score
–
Published
2026-10-28
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net/kafkakafka4.3.1unaddressedtimp87@gmail.com

Template for a VuXML entry

This generator is not reliable at the moment

Package names, ranges and the XML itself can be wrong. Always check the content before you commit it, and run make validate in security/vuxml. The generator is being rewritten from scratch.

Range per package from the CVE record, for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kafka</name>
	<range><lt>4.3.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in
	  Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on
	  all platforms allows an authenticated attacker with CLUSTER_ACTION
	  privilege to cause a denial of service (controller process
	  termination) via a crafted FetchSnapshotRequest with an empty topics
	  array or a topic with no partitions.</p>
	<p>Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0,
	  which fix this issue. Users on unsupported branches (4.1.x and
	  earlier) should upgrade to 4.2.2 or later.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-83525</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-83525</url>
    </references>
    <dates>
      <discovery>2026-10-28</discovery>
      <entry>2026-10-28</entry>
    </dates>
  </vuln>