CVE-2022-3786
HighOpenSSL: X.509 Email Address Variable Length Buffer Overflow
Published Dec 12, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2022-3786, BIT-node-2022-3786, BIT-node-min-2022-3786, DEBIAN-CVE-2022-3786, GHSA-h8jm-2x53-xhp5, RUSTSEC-2022-0065, SUSE-SU-2022:4586-1, UBUNTU-CVE-2022-3786
Key Facts
Patch immediately- CVE-2022-3786 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Node.js (Nodejs), OpenSSL, Fedora (Fedoraproject) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 92% probability of exploitation in the next 30 days.
- Fixed versions are available, including cargo-audit-advisory-db 20221102-1.1, libopenssl-3-devel 3.0.1-150400.4.11.1, libopenssl-3-devel 3.0.1-150400.4.14.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
92%
Higher than 99.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-3786 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the .' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
Affected Products
117 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Node.jsNodejs | 18.12.0, 19.0.0 | 18.11.0 |
| OpenSSLOpenssl | >= 3.0.0 | 3.0.7 |
| FedoraFedoraproject | 36, 37 | n/a |
| nodejsalpine | See advisory | 18.12.1-r0 |
| openssl3alpine | See advisory | 3.0.7-r0 |
Patched Releases
cargo-audit-advisory-db
20221102-1.1
libopenssl-3-devel
3.0.1-150400.4.11.1, 3.0.1-150400.4.14.1, 3.0.7-1.1
libopenssl-3-devel-32bit
3.0.1-150400.4.11.1, 3.0.1-150400.4.14.1, 3.0.7-1.1
libopenssl3
3.0.1-150400.4.11.1, 3.0.1-150400.4.14.1, 3.0.7-1.1
libopenssl3-32bit
3.0.1-150400.4.11.1, 3.0.1-150400.4.14.1, 3.0.7-1.1
node
18.11.0, 18.12.1, 19.0.1
node-min
18.11.0, 18.12.1, 19.0.1
nodejs
1:18.12.1-1.amzn2023.0.2, 18.12.1-r0, 18.16.0-1.ph5, 18.20.8-1.ph4
Node.js
18.11.0
nodejs-devel
1:18.12.1-1.amzn2023.0.2, 18.16.0-1.ph5, 18.20.8-1.ph4
nodejs-docs
1:18.12.1-1.amzn2023.0.2
nodejs-full-i18n
1:18.12.1-1.amzn2023.0.2
nodejs-libs
1:18.12.1-1.amzn2023.0.2
npm
1:8.19.2-1.18.12.1.1.amzn2023.0.2
OpenSSL
1:3.0.1-43.0.1.el9_0, 1:3.0.1-43.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 1.1.1t-r35341999, 1.1.1w-0+deb11u2+sp999, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0, 3.0.2-0ubuntu1.7, 3.0.6-2.ph4, 3.0.7, 3.0.7-1, 3.0.7-r0
openssl-3
3.0.1-150400.4.11.1, 3.0.1-150400.4.14.1, 3.0.7-1.1
openssl-3-doc
3.0.1-150400.4.11.1, 3.0.1-150400.4.14.1, 3.0.7-1.1
openssl-c_rehash
3.0.6-2.ph4
openssl-devel
1:3.0.1-43.0.1.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0, 3.0.6-2.ph4
openssl-docs
3.0.6-2.ph4
openssl-libs
1:3.0.1-43.0.1.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0
openssl-perl
1:3.0.1-43.0.1.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0, 3.0.6-2.ph4
openssl-src
300.0.11
openssl3
3.0.7-r0
python310-cryptography
38.0.3-1.1
Timeline
Publicly disclosed
Dec 12, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-805 Buffer Access with Incorrect Length Value
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3602
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3786
- advisoryRHSA-2022:7288
- advisoryRHSA-2022:7384
- advisoryhttps://blog.qualys.com/vulnerabilities-threat-research/2022/11/08/november-2022-patch-tuesday
FAQ
Common Questions.
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.
Affected: Node.js (Nodejs) versions 18.12.0, 19.0.0; OpenSSL versions >= 3.0.0; Fedora (Fedoraproject) versions 36, 37, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including cargo-audit-advisory-db 20221102-1.1, libopenssl-3-devel 3.0.1-150400.4.11.1, libopenssl-3-devel 3.0.1-150400.4.14.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-3786 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo