VYPR
Get started
← All advisories
High severity7.5NVD Advisory· Published Nov 1, 2022· Updated Apr 14, 2026

CVE-2022-3786

CVE-2022-3786

Description

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openssl-srccrates.io
>= 300.0.0, < 300.0.11300.0.11

Affected products

6
  • OpenSSL Project/OpenSSL
    cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
    Range: >=3.0.0,<3.0.7
  • Fedoraproject/Fedora2 versions
    cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
  • Node.js/Node.js3 versions
    cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*+ 2 more
    • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*range: >=18.0.0,<18.11.0
    • cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:*
    • cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:*

Patches

4
8c1dd95f3cc5
https://github.com/nodejs/nodevia osv
19cc035b6c6f
https://github.com/openssl/opensslvia osv
4a31c14f31e1

Bump to OpenSSL 3.0.7

https://github.com/alexcrichton/openssl-src-rsSteven FacklerNov 1, 2022via ghsa
commit
2 files changed · +2 −2
  • Cargo.toml+1 −1 modified
    @@ -1,6 +1,6 @@
 [package]
 name = "openssl-src"
-version = "300.0.10+3.0.6"
+version = "300.0.11+3.0.7"
 authors = ["Alex Crichton <alex@alexcrichton.com>"]
 license = "MIT/Apache-2.0"
 readme = "README.md"
  • openssl+1 −1 modified
    @@ -1 +1 @@
-Subproject commit 75a6bc17f32505421a78476a972d4d9b74f303b6
+Subproject commit 19cc035b6c6f2283573d29c7ea7f7d675cf750ce
fe3b639dc19b

Fix CVE-2022-3602 in punycode decoder.

https://github.com/openssl/opensslPauliOct 26, 2022via ghsa
commit
1 file changed · +1 −1
  • crypto/punycode.c+1 −1 modified
    @@ -181,7 +181,7 @@ int ossl_punycode_decode(const char *pEncoded, const size_t enc_len,
         n = n + i / (written_out + 1);
         i %= (written_out + 1);
 
-        if (written_out > max_out)
+        if (written_out >= max_out)
             return 0;
 
         memmove(pDecoded + i + 1, pDecoded + i,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

49

News mentions

0

No linked articles in our index yet.