CVE-2022-34917 - CVE House
Back to Database
Status published Unknown CVE-2022-34917

Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

Vulnerability Description

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-34917

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Apache Kafka would like to thank Mickael Maison, Tom Bentley and Daniel Collins for reporting this issue.

Affected Vendor

Apache Software Foundation

View all reports →

Affected Software

Apache Kafka
Vulnerable Versions:
Apache Kafka 2.8.0 2.8.0 , Apache Kafka 2.8.1 2.8.1, Apache Kafka 3.0.0 3.0.0, Apache Kafka 3.0.1 3.0.1, Apache Kafka 3.1.0 3.1.0, Apache Kafka 3.1.1 3.1.1, Apache Kafka 3.2.0 3.2.0, Apache Kafka 3.2.1 3.2.1

Timeline

Official Publish: September 20th, 2022
Last Modified: May 29th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.