Resource leakage when decoding certificates and keys
Priority MEDIUM 46CWE-459Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-404.
Summary
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04678 91st percentileScored 2026-11-07
Fix Fixed openssl-src (crates.io): 300.0.6Red Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2) | — | No fix listed | CNA |
| — | openssl-src (crates.io) | 300.0.0 to before 300.0.6 | 300.0.6 | Patch available | GHSA-g323-fr93-4j3c |
- OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2) Fixed in — No fix listed CNA
- openssl-src (crates.io) Vendor— Affected 300.0.0 to before 300.0.6 Fixed in 300.0.6 Patch available GHSA-g323-fr93-4j3c
CPE configurations NVD · 43
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 3.0.0 to before 3.0.3 | Vulnerable | OpenSSL |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.3 Vulnerable ·OpenSSL
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 33 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
- Fix · GHSA-g323-fr93-4j3c openssl-src (crates.io) Fixed in 300.0.6 Advisory →
Red Hat 1 advisory
- RHSA-2022:6224 Released 2022-08-30 · Red Hat rating Moderateopenssl security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-41.el9_0, openssl-perl-1:3.0.1-41.el9_0
- Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-41.el9_0, openssl-libs-1:3.0.1-41.el9_0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:6224 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2022:6224 |
Not affected: 7 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat JBoss Web Server 3
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1473
- 2026-10-03 Alias added: GHSA-g323-fr93-4j3c
- 2026-10-16 EPSS moved to the 90th–95th percentile
References
Advisory 4
Other 6
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=64c85430f95200b6b51fe9475bd5203f7c19daf1
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
- https://github.com/github/advisory-database/issues/405
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=64c85430f95200b6b51fe9475bd5203f7c19daf1
- https://rustsec.org/advisories/RUSTSEC-2022-0025.html
- https://security.netapp.com/advisory/ntap-20220602-0009
More Openssl vulnerabilities
- TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
Sources
- CVE-2022-1473 · CVE Program
- CVE-2022-1473 · NVD
- FIRST EPSS
- GHSA-g323-fr93-4j3c · GitHub Advisory Database · CC BY 4.0
- CVE-2022-1473 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences