Read the docs
TI-2022-06314 Aliases CVE-2022-21952GHSA-99mv-pfx6-v678

SUMA unauthenticated remote DoS via resource exhaustion

Priority LOW 36CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-770.

Summary

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

Why it matters now

EPSS 0.01546 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed SUSE Manager Server 4.1 (SUSE): 4.1.46SUSE Manager Server 4.2 (SUSE): 4.2.37

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Manager Server 4.1spacewalk-java to before 4.1.464.1.46Patch availableCNA
SUSESUSE Manager Server 4.2spacewalk-java to before 4.2.374.2.37Patch availableCNA
  • SUSE Manager Server 4.1 VendorSUSE Affected spacewalk-java to before 4.1.46 Fixed in 4.1.46 Patch available CNA
  • SUSE Manager Server 4.2 VendorSUSE Affected spacewalk-java to before 4.2.37 Fixed in 4.2.37 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:manager_server:*:*:*:*:*:*:*:*4.1 to before 4.1.46; 4.2 to before 4.2.37VulnerableSUSE
  • cpe:2.3:a:suse:manager_server:*:*:*:*:*:*:*:* Versions 4.1 to before 4.1.46; 4.2 to before 4.2.37 Vulnerable ·SUSE

Remediation

  • Fix · CNA SUSE Manager Server 4.1 (SUSE) Fixed in 4.1.46
  • Fix · CNA SUSE Manager Server 4.2 (SUSE) Fixed in 4.2.37

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21952
  2. 2026-10-03 Alias added: GHSA-99mv-pfx6-v678

References

Exploit 1

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2021-02923 Out-of-bounds write in polkit KEVCVSS 3.1HIGH 7.8
  • TI-2023-13920 The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker… KEVCVSS 3.1HIGH 7.5
  • TI-2023-08821 JWT token compromise can allow malicious actions including Remote Code Execution (RCE) CVSS 4.0CRITICAL 9.4
  • TI-2022-10358 In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip=… CVSS 3.1HIGH 7.8
  • TI-2022-13281 SUMA user enumeration via weak error message CVSS 3.1MEDIUM 5.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences