Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.kafka:kafka | >= 2.8.0, < 2.8.2, >= 3.0.0, < 3.0.2, >= 3.1.0, < 3.1.2, >= 3.2.0, < 3.2.3 | 2.8.2, 3.0.2, 3.1.2, 3.2.3 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2022-34917
- https://github.com/apache/kafka/commit/14951a83e3fdead212156e5532359500d72f68bc
- https://github.com/apache/kafka/commit/2bfa24b2bd416e7b8c4a0c566b984c43904fdecb
- https://github.com/apache/kafka/commit/aaceb6b79bfcb1d32874ccdbc8f3138d1c1c00fb
- https://github.com/apache/kafka/commit/c1295662768e64b4467e27c3d5158f95f2307657
- https://issues.apache.org/jira/browse/KAFKA-14063
- https://kafka.apache.org/cve-list
- https://kafka.apache.org/cve-list#CVE-2022-34917
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-400, CWE-770, CWE-789- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.apache.kafka:kafka- Publicada
- 21.09.2022
- Actualizado
- 11.10.2026 12:21
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-c9h3-c6qj-hh7q - CC BY 4.0
Historial de vulnerabilidades: org.apache.kafka:kafka
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 05.2020 09.2022
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 3
- Media 1
Divulgaciones por año
- 2020: 1
- 2021: 0
- 2022: 3
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.