Skip to main content
Public proof of conceptFix available

CVE-2022-3786

A public proof of concept exists; no exploitation attested.

  • Published2022-11-01
  • Fixed in18.11.0
  • WeaknessCWE-120

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

Timeline

dates in UTC
  1. 2022-11-0118:15CVE publishedNVD
  2. 2026-10-2319:23First public proof of conceptPoC-in-GitHub
  3. 2026-10-2319:23EPSS crossed 10 %FIRST EPSS

Observed activity

isMalicious corpus · updated 2026-10-23 18:48 UTC
Indicators tagged with this CVE, per day0 indicators over 7 days
Block these indicators
  • Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2022-3786?format=txt
  • CSV export: https://api.ismalicious.com/edl/cve/CVE-2022-3786?format=csv
  • TAXII collection of exploited CVEs
  • The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD
Node.js
BranchAffectedFixed in
18.x≥ 18.0.0, < 18.11.018.11.0
18.12= 18.12.0no fix published
19.0= 19.0.0no fix published
Fedoraproject fedora
BranchAffectedFixed in
36.x= 36no fix published
37.x= 37no fix published
OpenSSL
BranchAffectedFixed in
3.0≥ 3.0.0, < 3.0.73.0.7

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • ICSA-23-229-01 CISA1 known affected

    ICONICS and Mitsubishi Electric Products

    ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI: 10.97.2

  • ICSA-23-019-01 CISA2 known affected

    Hitachi Energy PCU400

    PCU400: PCU400: Versions 9.3.0 and later up to but not including 9.3.8 · PCU400: PCULogger tool: Version 1.0.1

  • ICSA-22-349-10 CISA5 known affected

    Siemens APOGEE/TALON Field Panels

    Calibre ICE · Mcenter · SCALANCE X-200RNA switch family · +2 more

  • ICSA-22-349-09 CISA9 known affected

    Siemens Products affected by OpenSSL 3.0

    Calibre ICE · Mcenter · SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) · +6 more

  • ICSA-22-349-12 CISA5 known affected

    Siemens Parasolid

    Calibre ICE · Mcenter · SCALANCE X-200RNA switch family · +2 more

Full record on NVD

Fix

  1. Update Node.js to 18.11.0
  2. Vendor fix CISA ICSA-23-019-01 · 2 productsPCU400: Version 9.3.8 or 9.4 or later
  3. Vendor fix CISA ICSA-22-349-10 · 1 productUpdate to V2.20 or later version
  4. Vendor fix CISA ICSA-22-349-10 · 1 productUpdate to V2023.1 or later version
  5. Vendor fix CISA ICSA-22-349-09 · 1 productUpdate to V2.13.0.3 or later version
  6. Vendor fix CISA ICSA-22-349-09 · 5 productsUpdate to V3.2.8 or later version
  7. Vendor fix CISA ICSA-22-349-09 · 1 productUpdate to V5.3.0 or later version

Advisories and patches

Detection

read 2026-10-23 19:23 UTC
Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof-of-concept repositories
1 repository, unverifiedWhatTheFuzz/openssl-fuzz
PoC-in-GitHub

Sources

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
2022-11-01
Last Modified
2026-06-17
NVD status
Modified

Frequently asked questions

What is CVE-2022-3786?

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

Is CVE-2022-3786 actively exploited?

Active exploitation of CVE-2022-3786 has not been confirmed. Its EPSS score was 92.5% on 2026-10-22, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-3786?

CVE-2022-3786 has a CVSS v3 base score of 7.5 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, October 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database