CVE-2022-34917: Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-20 · updated 2026-06-17
Weakness: CWE-789

Description

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.

Affected products

Apache Kafka: from 2.8.0 before 2.8.2; from 3.0.0 before 3.0.2; from 3.1.0 before 3.1.2; from 3.2.0 before 3.2.3 — fixed in 2.8.2, 3.0.2, 3.1.2, 3.2.3

How to fix

Upgrade to a fixed version: Apache Kafka 2.8.2, 3.0.2, 3.1.2, 3.2.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-34917 or the next vulnerability affects your stack