BIT-kafka-2022-34917

    Dashboard / Vulnerabilities / BIT-kafka-2022-34917

    BIT-kafka-2022-34917

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

    Details: A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.

    References: https://kafka.apache.org/cve-list, https://nvd.nist.gov/vuln/detail/CVE-2022-34917

    Affected packages

    Package

    Name: kafka

    Purl: pkg:bitnami/kafka

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 2.8.0
    Fixed -2.8.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-kafka-2022-34917 | CVE-DB