Use of Uninitialized Variable in trilogy
Priority LOW 35CWE-908Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-908 and the CVSS impact.
Summary
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01094 65th percentileScored 2026-11-07
Fix Fixed trilogy (github): 2.1.1trilogy (RubyGems): 2.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GitHub | trilogy | before 2.1.1 | 2.1.1 | Patch available | CNA |
| — | trilogy (RubyGems) | before 2.1.1 | 2.1.1 | Patch available | GHSA-5g4r-2qhx-vqfm |
- trilogy VendorGitHub Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
- trilogy (RubyGems) Vendor— Affected before 2.1.1 Fixed in 2.1.1 Patch available GHSA-5g4r-2qhx-vqfm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trilogy_project:trilogy:*:*:*:*:*:ruby:*:* | before 2.1.1 | Vulnerable | Trilogy Project |
- cpe:2.3:a:trilogy_project:trilogy:*:*:*:*:*:ruby:*:* Versions before 2.1.1 Vulnerable ·Trilogy Project
Remediation
- Fix · CNA trilogy (github) Fixed in 2.1.1
- Fix · GHSA-5g4r-2qhx-vqfm trilogy (RubyGems) Fixed in 2.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31026
- 2026-10-03 Alias added: GHSA-5g4r-2qhx-vqfm
References
Advisory 2
More GitHub vulnerabilities
- TI-2024-04632 An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES)… CVSS 4.0CRITICAL 10.0
- TI-2024-00181 Unsafe Reflection in Github Enterprise Server leading to Command Injection CVSS 3.1CRITICAL 9.8
- TI-2024-00466 Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server CVSS 3.1HIGH 8.8
- TI-2022-08539 Integer overflow in table parsing extension leads to heap memory corruption CVSS 3.1CRITICAL 9.8
- TI-2026-34990 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler CVSS 3.1HIGH 7.5
- TI-2026-32884 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor CVSS 4.0HIGH 8.5
Sources
- CVE-2022-31026 · CVE Program
- CVE-2022-31026 · NVD
- FIRST EPSS
- GHSA-5g4r-2qhx-vqfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences