CVE-2022-34917

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.

• CWE-789
• CWE-770

• https://kafka.apache.org/cve-listVendor Advisory
• https://kafka.apache.org/cve-listVendor Advisory

Published

Sep 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34910An issue was discovered in the A4N (Aremis 4 Nomad) applicat…5.5
• CVE-2022-34911An issue was discovered in MediaWiki before 1.35.7, 1.36.x a…6.1
• CVE-2022-34912An issue was discovered in MediaWiki before 1.37.3 and 1.38.…6.1
• CVE-2022-34913md2roff 1.7 has a stack-based buffer overflow via a Markdown…9.8
• CVE-2022-34914Webswing before 22.1.3 allows X-Forwarded-For header injecti…9.8
• CVE-2022-34916Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to…9.8
• CVE-2022-34918An issue was discovered in the Linux kernel through 5.18.9. …7.8
• CVE-2022-34919The file upload wizard in Zengenti Contensis Classic before …9.8
• CVE-2022-3492A vulnerability classified as critical was found in SourceCo…8.8
• CVE-2022-34924Lanling OA Landray Office Automation (OA) internal patch num…7.5
• CVE-2022-34927MilkyTracker v1.03.00 was discovered to contain a stack over…7.8
• CVE-2022-34928JFinal CMS v5.1.0 was discovered to contain a SQL injection …8.8