CVE-2022-38667
CVSS v3
9.8
CRITICAL
EPSS Score
3.4 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.
Technical details
- Published
- 2022-08-22
Frequently asked questions
What is CVE-2022-38667?
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.
Is CVE-2022-38667 actively exploited?
Active exploitation of CVE-2022-38667 has not been confirmed. The EPSS score is 3.4%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2022-38667?
CVE-2022-38667 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2022-38667 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2022 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).