PT-2022-6072 · Apache · Apache Kafka

Published 2022-09-20 · Updated 2025-05-29 · CVE-2022-34917

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 2.8.0 through 3.2.2 Apache Kafka versions 2.8.0 through 3.1.1 Apache Kafka versions 2.8.0 through 3.0.1 Apache Kafka versions 2.8.0 through 2.8.1

Description A security issue in Apache Kafka is related to uncontrolled resource allocation or throttling. Exploitation of this issue can allow a remote attacker to cause a denial of service. The issue affects all releases since 2.8.0 and allows malicious unauthenticated clients to allocate large amounts of memory on brokers, leading to OutOfMemoryException. Example scenarios include Kafka clusters without authentication, with SASL authentication, and with TLS authentication, where clients can trigger the issue under different conditions.

Recommendations To resolve the issue, upgrade the Kafka installations to one of the following versions: 3.2.3, 3.1.2, 3.0.2, or 2.8.2. As a temporary workaround, consider restricting network connections to brokers to minimize the risk of exploitation. Restrict access to the Kafka cluster to only trusted clients to reduce the risk of denial of service. Avoid using Kafka clusters without authentication or with weak authentication mechanisms until the issue is resolved.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-789

CWE-770

Related Identifiers

BDU:2023-00007

BIT-KAFKA-2022-34917

CVE-2022-34917

GHSA-C9H3-C6QJ-HH7Q

OESA-2022-2062

Affected Products

Apache Kafka

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2022-34917 · Security Note
• https://kafka.apache.org/cve-list · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/687309 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34917 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2062 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kafka-2022-34917 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-12399 · Security Note
• https://osv.dev/vulnerability/GHSA-c9h3-c6qj-hh7q · Vendor Advisory
• https://github.com/apache/kafka/commit/aaceb6b79bfcb1d32874ccdbc8f3138d1c1c00fb · Note
• https://github.com/apache/kafka/commit/c1295662768e64b4467e27c3d5158f95f2307657 · Note
• https://github.com/apache/kafka/commit/2bfa24b2bd416e7b8c4a0c566b984c43904fdecb · Note
• https://github.com/apache/kafka/commit/14951a83e3fdead212156e5532359500d72f68bc · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2062 · Note
• https://issues.apache.org/jira/browse/KAFKA-14063 · Note