Every CVE Search/ Get API key

CVE-2022-34038

etcd denial of service vulnerability

7.5 HighFix availableDisputed

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.75%Up 1.7 points since Aug 23, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.

Record
CVE-2022-34038
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.

Record
CVE-2022-34038
Updated
2026-11-02
EUVDEUVD-2023-2222 No score

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.

Record
EUVD-2023-2222
Updated
2026-11-03
GitHub AdvisoriesGHSA-65rp-cv85-263x 7.5

etcd denial of service vulnerability

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go

Record
GHSA-65rp-cv85-263x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVGHSA-65rp-cv85-263x 7.5

etcd denial of service vulnerability

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go

Record
GHSA-65rp-cv85-263x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVOESA-2025-1168 9.8

etcd security update

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

Record
OESA-2025-1168
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2025-1169 9.8

etcd security update

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

Record
OESA-2025-1169
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1170 9.8

etcd security update

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

Record
OESA-2025-1170
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-etcd-2022-34038 No score

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.

Record
BIT-etcd-2022-34038
Updated
2026-11-02
OSV No score

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.

Record
CVE-2022-34038
Updated
2026-11-02
OSVDEBIAN-CVE-2022-34038 No score

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.

Record
DEBIAN-CVE-2022-34038
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
etcd
Bitnami
 3.5.4 up to 3.5.5
3.5.5
etcd
Debian:12
 All versions, plus listed versions
3.4.23-43.4.23-53.4.23-63.4.30-13.4.30-2
Show 25 moreShow less
3.4.30-33.5.15-13.5.15-23.5.15-33.5.15-43.5.15-53.5.15-63.5.15-73.5.16-13.5.16-103.5.16-113.5.16-23.5.16-33.5.16-43.5.16-53.5.16-63.5.16-73.5.16-83.5.16-93.5.22-13.5.22-23.5.30-1~exp13.5.30-1~exp23.5.30-23.5.5-1
 None known
etcd
Debian:13
 All versions, plus listed versions
3.5.16-103.5.16-113.5.16-43.5.16-53.5.16-6
Show 8 moreShow less
3.5.16-73.5.16-83.5.16-93.5.22-13.5.22-23.5.30-1~exp13.5.30-1~exp23.5.30-2
 None known
etcd
Debian:14
 All versions, plus listed versions
3.5.16-103.5.16-113.5.16-43.5.16-53.5.16-6
Show 8 moreShow less
3.5.16-73.5.16-83.5.16-93.5.22-13.5.22-23.5.30-1~exp13.5.30-1~exp23.5.30-2
 None known
etcd
openEuler:20.03-LTS-SP4
From an advisory covering 5 CVEs
 before 3.4.14-9.oe2003sp4
3.4.14-9.oe2003sp4
etcd
openEuler:22.03-LTS-SP3
From an advisory covering 5 CVEs
 before 3.4.14-8.oe2203sp3
3.4.14-8.oe2203sp3
etcd
openEuler:22.03-LTS-SP4
From an advisory covering 5 CVEs
 before 3.4.14-11.oe2203sp4
3.4.14-11.oe2203sp4

History

History
RecordedChangedSources
affected, factsOSV
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-34038 is a high vulnerability (CVSS 7.5) in Etcd, published August 22, 2023. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.75%, the 78th percentile. Fixed in etcd 3.5.5.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open