Read the docs
TI-2022-09440 Aliases CVE-2022-25881GHSA-rc47-6667-2j5j

Regular expression denial of service in http-cache-semantics

Priority HIGH 68CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 9 fixed, 17 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01613 76th percentileScored 2026-11-07
Fix Partial http-cache-semantics: 4.1.1org.webjars.npm:http-cache-semantics: 4.1.1+2 more productsRed Hat: 15 advisoriesRed Hat: 9 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—http-cache-semanticsbefore 4.1.14.1.1Patch availableCNA
—org.webjars.npm:http-cache-semanticsbefore 4.1.14.1.1Patch availableCNA
—http-cache-semantics (npm)before 4.1.14.1.1Patch availableGHSA-rc47-6667-2j5j
—org.webjars.npm:http-cache-semantics (Maven)before 4.1.14.1.1Patch availableGHSA-rc47-6667-2j5j
  • http-cache-semantics Vendor— Affected before 4.1.1 Fixed in 4.1.1 Patch available CNA
  • org.webjars.npm:http-cache-semantics Vendor— Affected before 4.1.1 Fixed in 4.1.1 Patch available CNA
  • http-cache-semantics (npm) Vendor— Affected before 4.1.1 Fixed in 4.1.1 Patch available GHSA-rc47-6667-2j5j
  • org.webjars.npm:http-cache-semantics (Maven) Vendor— Affected before 4.1.1 Fixed in 4.1.1 Patch available GHSA-rc47-6667-2j5j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:*:*:*:*:*:node.js:*:*before 4.1.1VulnerableHttp-cache-semantics Project
  • cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:*:*:*:*:*:node.js:*:* Versions before 4.1.1 Vulnerable ·Http-cache-semantics Project

Remediation

  • Fix · CNA http-cache-semantics Fixed in 4.1.1
  • Fix · CNA org.webjars.npm:http-cache-semantics Fixed in 4.1.1
  • Fix · GHSA-rc47-6667-2j5j http-cache-semantics (npm) Fixed in 4.1.1 Advisory →
  • Fix · GHSA-rc47-6667-2j5j org.webjars.npm:http-cache-semantics (Maven) Fixed in 4.1.1 Advisory →

Red Hat 15 advisories

  • RHSA-2023:5533 Released 2023-10-09 · Red Hat rating Important
    nodejs security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs-1:16.20.2-1.el9_0, nodejs-docs-1:16.20.2-1.el9_0, nodejs-full-i18n-1:16.20.2-1.el9_0 +2
  • RHSA-2023:3815 Released 2023-06-27 · Red Hat rating Important
    Service Registry (container images) release and security update [2.4.3 GA]
    • RHINT Service Registry 2.4.3 GA
  • RHSA-2023:2655 Released 2023-05-09 · Red Hat rating Moderate
    nodejs and nodejs-nodemon security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.19.1-1.el9_2, nodejs-docs-1:16.19.1-1.el9_2, nodejs-full-i18n-1:16.19.1-1.el9_2 +3
Show 12 more Red Hat advisories
  • RHSA-2023:2654 Released 2023-05-09 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18 +20
  • RHSA-2023:2104 Released 2023-05-03 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.5.8 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
  • RHSA-2023:2098 Released 2023-05-03 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.0.8 security updates and bug fixes
    • multicluster engine for Kubernetes 2.0 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +35
  • RHSA-2023:2083 Released 2023-05-02 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.6.5 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2023:2061 Released 2023-05-01 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.1.6 security updates and bug fixes
    • multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
  • RHSA-2023:1744 Released 2023-04-12 · Red Hat rating Important
    rh-nodejs14-nodejs security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-3.6-2.el7, rh-nodejs14-nodejs-14.21.3-2.el7, rh-nodejs14-nodejs-devel-14.21.3-2.el7 +5
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-3.6-2.el7, rh-nodejs14-nodejs-14.21.3-2.el7, rh-nodejs14-nodejs-devel-14.21.3-2.el7 +5
  • RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
  • RHSA-2023:1743 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x::nodejs:14 +19
  • RHSA-2023:1583 Released 2023-04-04 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.aarch64::nodejs:18, nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.ppc64le::nodejs:18, nodejs-1:18.14.2-2.module+el8.7.0+18445+9493b6ea.s390x::nodejs:18 +20
  • RHSA-2023:1582 Released 2023-04-04 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64::nodejs:16, nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le::nodejs:16, nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x::nodejs:16 +19
  • RHSA-2023:1533 Released 2023-03-30 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19
  • RHSA-2023:1428 Released 2023-03-23 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.8 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-ui-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET 6.0 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Discovery 1AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix yet
8Base-RHMTC-1.7Fixed RHSA-2023:1428
RHINT Service Registry 2.4.3 GAFixed RHSA-2023:3815
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:1582, RHSA-2023:1583, RHSA-2023:1743
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2654, RHSA-2023:2655
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1533
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1742
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:5533
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:1744
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:1744
Not affected: 10 products
  • 8Base-RHMTC-1.7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-25881
  2. 2026-10-03 Alias added: GHSA-rc47-6667-2j5j

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences