CVE-2022-3786highCWE-120

CVE-2022-3786: high-severity vulnerability in OpenSSL

X.509 Email Address Variable Length Buffer Overflow

Published · Updated

Follow this CVE+ Monitor OpenSSL+ Monitor openssl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 92%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
2 products (57 components)
Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux BaseOS (v. 9)
fix ↗
Under investigation
1 product
Logging Subsystem for Red Hat OpenShift
Not affected
10 products (50 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 6 · Red Hat Virtualization 4 · and others 5
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OpenSSL · OpenSSL
Related CVEs — OpenSSL

In the same product, most dangerous first.

CVE-2022-2068CRITICALThe c_rehash script allows command injectionEPSS 96.4%CVE-2022-3602HIGHX.509 Email Address 4-byte Buffer OverflowEPSS 90.8%CVE-2021-3711—SM2 Decryption Buffer OverflowEPSS 87.8%CVE-2022-1292CRITICALThe c_rehash script allows command injectionEPSS 82.6%CVE-2023-2650MEDIUMPossible DoS translating ASN.1 object identifiersEPSS 75.4%CVE-2025-15467HIGHStack buffer overflow in CMS (Auth)EnvelopedData parsingEPSS 74.8%