CVE-2022-36087mediumCWE-20

CVE-2022-36087: falha de média gravidade em oauthlib

OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar oauthlib+ Monitorar python-oauthlib

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.7epss 1.8%
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Produtos afetados
oauthlib · oauthlib
CVEs relacionadas — oauthlib

No mesmo produto, das mais perigosas para as menos.

CVE-2026-49272HIGHOAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflowEPSS 0.3%CVE-2026-118669HIGHOAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientEPSS 0.3%CVE-2026-49265MEDIUMOAuthLib: Timing Attack Vulnerability in PKCE code_verifier ComparisonEPSS 0.2%CVE-2026-49264MEDIUMOAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationEPSS 0.2%