Threats tagged 'ghsa-34hc-fwhq-c7v8'

An incorrect operator vulnerability (CWE-480) exists in the FetchSnapshot RPC handler of Apache Kafka versions from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2. This flaw allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service by terminating the controller process via a crafted FetchSnapshotRequest containing an empty topics array or a topic with no partitions. Fixed versions include 4.2.2, 4.3.2, and 4.4.0.