CVE-2022-34917
Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
At a glance
- Source
- NVD
- EPSS
- EPSS 1.48 % · percentile 74 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
Weaknesses (CWE)
- CWE-789 — Memory Allocation with Excessive Size Value
- CWE-770 — Allocation of Resources Without Limits or Throttling
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-c9h3-c6qj-hh7q — Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service
European references
- ENISA EUVD · EUVD-2022-6777
- GCVE · GCVE-0-2022-34917
CERT-FR advisories
- CERTFR-2025-AVI-0086 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0513 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0276 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 2.8.0 < 2.8.2cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.2cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.1.2cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.3
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Kafka | affected Apache Kafka 2.8.0 2.8.0 ; affected Apache Kafka 2.8.1 2.8.1 ; affected Apache Kafka 3.0.0 3.0.0 ; affected Apache Kafka 3.0.1 3.0.1 ; affected Apache Kafka 3.1.0 3.1.0 ; affected Apache Kafka 3.1.1 3.1.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |