{"cve":"CVE-2022-3786","nvd":{"published":"2022-11-01T18:15:11.047","modified":"2026-06-17T05:00:18.193","status":"Modified","description":"A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-120"],"references":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a","https://www.openssl.org/news/secadv/20221101.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.html","https://www.kb.cert.org/vuls/id/794340"],"products":["fedoraproject:fedora","nodejs:node.js","openssl:openssl"],"source":"nvd","synced_at":"2026-10-19T21:37:08.729216836+00:00"},"epss":{"cve":"CVE-2022-3786","score":0.92488,"percentile":0.99826,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-h8jm-2x53-xhp5","url":"https://osv.dev/vulnerability/GHSA-h8jm-2x53-xhp5","summary":"X.509 Email Address Variable Length Buffer Overflow","modified":"2026-09-10T03:49:49.922157998Z","packages":[{"ecosystem":"crates.io","name":"openssl-src","purl":"pkg:cargo/openssl-src","ranges":[">=300.0.0 <300.0.11"],"fixed":["300.0.11"]}]},{"id":"RUSTSEC-2022-0065","url":"https://osv.dev/vulnerability/RUSTSEC-2022-0065","summary":"X.509 Email Address Variable Length Buffer Overflow","modified":"2024-12-16T15:27:12.425468Z","packages":[{"ecosystem":"crates.io","name":"openssl-src","purl":"pkg:cargo/openssl-src","ranges":[">=300.0.0 <300.0.11"],"fixed":["300.0.11"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}