Read the docs
TI-2022-04169 Aliases CVE-2022-4565GHSA-47vx-fqr5-j2gw

Dromara HuTool cn.hutool.core.util.ZipUtil.java resource consumption

Priority LOW 35CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-404.

Summary

A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.11 is able to address this issue. It is recommended to upgrade the affected component. VDB-215974 is the identifier assigned to this vulnerability.

Why it matters now

EPSS 0.00957 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cn.hutool:hutool-core (Maven): 5.8.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
dromaraHuTool5.8.0; 5.8.1; 5.8.2; 5.8.3; 5.8.4; 5.8.5; 5.8.6; 5.8.7; 5.8.8; 5.8.9; 5.8.10—No fix listedCNA
—cn.hutool:hutool-core (Maven)before 5.8.115.8.11Patch availableGHSA-47vx-fqr5-j2gw
  • HuTool Vendordromara Affected 5.8.0; 5.8.1; 5.8.2; 5.8.3; 5.8.4; 5.8.5; 5.8.6; 5.8.7; 5.8.8; 5.8.9; 5.8.10 Fixed in — No fix listed CNA
  • cn.hutool:hutool-core (Maven) Vendor— Affected before 5.8.11 Fixed in 5.8.11 Patch available GHSA-47vx-fqr5-j2gw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hutool:hutool:*:*:*:*:*:*:*:*up to 5.8.10VulnerableHutool
  • cpe:2.3:a:hutool:hutool:*:*:*:*:*:*:*:* Versions up to 5.8.10 Vulnerable ·Hutool

Remediation

  • Fix · GHSA-47vx-fqr5-j2gw cn.hutool:hutool-core (Maven) Fixed in 5.8.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4565
  2. 2026-10-03 Alias added: GHSA-47vx-fqr5-j2gw

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-28043 HertzBeat AviatorScript Inject RCE CVSS 3.1CRITICAL 9.8
  • TI-2023-24001 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2023-15126 Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. CVSS 3.1CRITICAL 9.8
  • TI-2025-41084 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface… CVSS 3.1CRITICAL 9.4
  • TI-2026-62126 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVSS 4.0HIGH 8.7
  • TI-2023-28044 HertzBeat SnakeYAML Deser RCE CVSS 3.1CRITICAL 9.8
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences