CVE-2022-34038 Denial of service in n/a
Remote attackers can cause a denial of service in etcd via a flaw in the PageWriter write function, though the vendor disputes this classification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-34038?
CVE-2022-34038 is a high-severity denial of service vulnerability in n/a, published on 22 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.
Weakness: CWE-787
Which versions are affected by CVE-2022-34038?
1 open source package ship an affected version, including etcd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
etcd Bitnami | From 3.5.4 | 3.5.5 |
Products include Etcd Etcd.
How do I fix CVE-2022-34038?
Upgrade etcd to 3.5.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-34038 being exploited?
There is no known exploitation of CVE-2022-34038 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-28235 Etcd-io Improper Authentication vulnerability
- CVE-2026-33413 etcd: Authorization bypasses in multiple APIs
- CVE-2018-16886 go.etcd.io/etcd Authentication Bypass
- CVE-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
- CVE-2020-15106 Improper Input Validation in etcd
Sources
Also known as BIT-etcd-2022-34038, DEBIAN-CVE-2022-34038.