CVE-2021-22565

6.5 mediumEPSS 0.4%

Medium (6.5) in google exposure notification verification server. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/google/exposure-notifications-verification-server 1.1.2.

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2021-12-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:exposure_notification_verification_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wx8q-rgfr-cf6v	Go	github.com/google/exposure-notifications-verification-server	<1.1.2	1.1.2
GO-2022-0270	Go	github.com/google/exposure-notifications-verification-server	<1.1.2	1.1.2

References

Check your stack JSON