Read the docs
TI-2022-15706 Aliases CVE-2022-34917GHSA-c9h3-c6qj-hh7q

Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

Priority MEDIUM 42CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.

Summary

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01483 74th percentileScored 2026-11-07
Fix Fixed org.apache.kafka:kafka (Maven): 2.8.2, 3.0.2, 3.1.2 +1Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache KafkaApache Kafka 2.8.0 2.8.0 ; Apache Kafka 2.8.1 2.8.1; Apache Kafka 3.0.0 3.0.0; Apache Kafka 3.0.1 3.0.1; Apache Kafka 3.1.0 3.1.0; Apache Kafka 3.1.1 3.1.1; Apache Kafka 3.2.0 3.2.0; Apache Kafka 3.2.1 3.2.1—No fix listedCNA
—org.apache.kafka:kafka (Maven)2.8.0 to before 2.8.22.8.2Patch availableGHSA-c9h3-c6qj-hh7q
—org.apache.kafka:kafka (Maven)3.0.0 to before 3.0.23.0.2Patch availableGHSA-c9h3-c6qj-hh7q
—org.apache.kafka:kafka (Maven)3.1.0 to before 3.1.23.1.2Patch availableGHSA-c9h3-c6qj-hh7q
—org.apache.kafka:kafka (Maven)3.2.0 to before 3.2.33.2.3Patch availableGHSA-c9h3-c6qj-hh7q
  • Apache Kafka VendorApache Affected Apache Kafka 2.8.0 2.8.0 ; Apache Kafka 2.8.1 2.8.1; Apache Kafka 3.0.0 3.0.0; Apache Kafka 3.0.1 3.0.1; Apache Kafka 3.1.0 3.1.0; Apache Kafka 3.1.1 3.1.1; Apache Kafka 3.2.0 3.2.0; Apache Kafka 3.2.1 3.2.1 Fixed in — No fix listed CNA
  • org.apache.kafka:kafka (Maven) Vendor— Affected 2.8.0 to before 2.8.2 Fixed in 2.8.2 Patch available GHSA-c9h3-c6qj-hh7q
  • org.apache.kafka:kafka (Maven) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-c9h3-c6qj-hh7q
  • org.apache.kafka:kafka (Maven) Vendor— Affected 3.1.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-c9h3-c6qj-hh7q
  • org.apache.kafka:kafka (Maven) Vendor— Affected 3.2.0 to before 3.2.3 Fixed in 3.2.3 Patch available GHSA-c9h3-c6qj-hh7q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*2.8.0 to before 2.8.2; 3.0.0 to before 3.0.2; 3.1.0 to before 3.1.2; 3.2.0 to before 3.2.3VulnerableApache
  • cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* Versions 2.8.0 to before 2.8.2; 3.0.0 to before 3.0.2; 3.1.0 to before 3.1.2; 3.2.0 to before 3.2.3 Vulnerable ·Apache

Remediation

  • Fix · GHSA-c9h3-c6qj-hh7q org.apache.kafka:kafka (Maven) Fixed in 2.8.2 Advisory →
  • Fix · GHSA-c9h3-c6qj-hh7q org.apache.kafka:kafka (Maven) Fixed in 3.0.2 Advisory →
  • Fix · GHSA-c9h3-c6qj-hh7q org.apache.kafka:kafka (Maven) Fixed in 3.1.2 Advisory →
  • Fix · GHSA-c9h3-c6qj-hh7q org.apache.kafka:kafka (Maven) Fixed in 3.2.3 Advisory →

Red Hat 1 advisory

  • RHSA-2022:6819 Released 2022-10-05 · Red Hat rating Important
    Red Hat AMQ Streams 2.2.0 release and security update
    • Red Hat AMQ Streams 2.2.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Streams 2.2.0Fixed RHSA-2022:6819
Not affected: 1 product
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-34917
  2. 2026-10-03 Alias added: GHSA-c9h3-c6qj-hh7q

References

Advisory 2

Other 6

  • TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
  • TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
  • TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
  • TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5
  • TI-2019-09246 Cleartext transmission of sensitive information in Apache Kafka CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences