Michael-JRead commented on PR #23185: URL: https://github.com/apache/kafka/pull/23185#issuecomment-5471374871
@kevin-wu24 @jsancio @uros-b Thanks for landing this fix. I'd like to raise an attribution point, courteously. I reported this same issue — the missing topic-partition validity check in the KRaft controller's FetchSnapshot RPC handling, where a malformed FetchSnapshotRequest can take down the active controller — privately to [email protected] on 3 August 2026, with a root-cause writeup and a working reproducer. That's ~17 days before this PR merged (20 August 2026). I never received an acknowledgement on that report. I'm not implying anything about how this PR originated — independent discovery is entirely possible, and this is a clean fix. I'm simply asking that, consistent with the ASF policy of crediting reporters, my prior disclosure be acknowledged: a reporter credit line in the release notes for the affected branches (4.2 / 4.3 / 4.4), and in any advisory or CVE that may follow. A few points in anticipation: The timeline is verifiable. My email to [email protected] is timestamped 2026-08-03 and contains the FetchSnapshot handler analysis (the incorrect-operator / missing-partition-check logic) plus a minimal reproducer. I'm glad to re-share it with the security list so precedence can be checked against this PR's history. Credit doesn't depend on a CVE. Assigned or not, acknowledging the reporter in the changelog is standard ASF practice — that's all I'm requesting. "Functional fix" vs. "security issue" doesn't change attribution. It was reported through the security channel as a controller-availability (DoS) problem and is remediated here; the reporter should still be credited. I'm happy to move this to [email protected] to keep it in the proper channel — I only wanted to make the connection visible here. Thanks again for the fix, and for maintaining Kafka. — Mike Read -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
