Read the docs
TI-2022-02786 Aliases CVE-2022-3023GHSA-7fxj-fr3v-r9gj

Use of Externally-Controlled Format String in pingcap/tidb

Priority HIGH 75CWE-134Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-134 and the CVSS impact.

Summary

Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Fixed pingcap/tidb (pingcap): 6.4.0, 6.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pingcappingcap/tidbbefore 6.4.0, 6.1.36.4.0, 6.1.3Patch availableCNA
—github.com/pingcap/tidb (Go)up to 6.1.2—No fix listedGHSA-7fxj-fr3v-r9gj
—github.com/pingcap/tidb (Go)6.2.0 – 6.4.0-alpha1—No fix listedGHSA-7fxj-fr3v-r9gj
  • pingcap/tidb Vendorpingcap Affected before 6.4.0, 6.1.3 Fixed in 6.4.0, 6.1.3 Patch available CNA
  • github.com/pingcap/tidb (Go) Vendor— Affected up to 6.1.2 Fixed in — No fix listed GHSA-7fxj-fr3v-r9gj
  • github.com/pingcap/tidb (Go) Vendor— Affected 6.2.0 – 6.4.0-alpha1 Fixed in — No fix listed GHSA-7fxj-fr3v-r9gj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pingcap:tidb:*:*:*:*:*:*:*:*before 6.4.0; 6.1.0 to before 6.1.3Vulnerablepingcap
  • cpe:2.3:a:pingcap:tidb:*:*:*:*:*:*:*:* Versions before 6.4.0; 6.1.0 to before 6.1.3 Vulnerable ·pingcap

Remediation

  • Fix · CNA pingcap/tidb (pingcap) Fixed in 6.4.0, 6.1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3023
  2. 2026-10-03 Alias added: GHSA-7fxj-fr3v-r9gj
  3. 2026-11-01 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 2

  • TI-2024-23494 PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer. CVSS 3.1HIGH 7.5
  • TI-2024-27622 PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component… CVSS 3.1MEDIUM 4.3
  • TI-2024-27621 PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component… CVSS 3.1CRITICAL 9.8
  • TI-2022-13056 TiDB authentication bypass vulnerability CVSS 3.1HIGH 7.8
  • TI-2022-15734 PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference. CVSS 3.1HIGH 7.5
  • TI-2024-22319 PingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences