{"id":"CVE-2022-3786","published":"2022-11-01T00:00:00Z","modified":"2026-04-14T08:58:03Z","title":"X.509 Email Address Variable Length Buffer Overflow","vendor":"OpenSSL","product":"OpenSSL","tier":"core","eol":null,"affectedVersions":[{"vendor":"OpenSSL","product":"OpenSSL","versions":[">= 3.0.0, < 3.0.7"]}],"description":{"text":"A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.\n\n","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.92488,"percentile":0.99825,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":50,"pulses":[{"name":"Zeus | Bleeding Life | Threat Graph","url":"https://otx.alienvault.com/pulse/6a5f77dd58636301950715e5","created":"2026-07-21"},{"name":"APT29","url":"https://otx.alienvault.com/pulse/69f46a108000bd36fe90d5be","created":"2026-05-01"},{"name":"ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 2025","url":"https://otx.alienvault.com/pulse/6807e1c45dd52410facbed8f","created":"2025-04-22"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - July 2024","url":"https://otx.alienvault.com/pulse/66a1221a4c2d00084ba3bcba","created":"2024-07-24"},{"name":"(I Cloned Title & Pulse) WHO EVERYONE HAS BEEN LOOKING FOR  [Pulse of  IoC's Curated  by user Streaming Ex]","url":"https://otx.alienvault.com/pulse/669f882c5109175fe742fe58","created":"2024-07-23"},{"name":"Elgoogle","url":"https://otx.alienvault.com/pulse/66480cb1cc174fd804e0cef9","created":"2024-05-18"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - January 2024","url":"https://otx.alienvault.com/pulse/65c0fd55c5d3c780a06aa227","created":"2024-02-05"},{"name":"Home Networks","url":"https://otx.alienvault.com/pulse/6570a756ee3c8ce2314e235a","created":"2023-12-06"},{"name":"WHO SAV.COM LLC (SOURCEADULT.COM)","url":"https://otx.alienvault.com/pulse/65709f0bbdd32cb4b343a12f","created":"2023-12-06"},{"name":"WHO SAV.COM LLC (SOURCEADULT.COM)","url":"https://otx.alienvault.com/pulse/65709eee2f74978bd15d60a9","created":"2023-12-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"https://www.openssl.org/news/secadv/20221101.txt","tags":["vendor-advisory"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a","tags":["patch"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.html","tags":[]},{"url":"https://www.kb.cert.org/vuls/id/794340","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-408105.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"crates.io","package":"openssl-src","vulnerableRanges":[">=300.0.0, <300.0.11"],"patched":["300.0.11"],"from":["GHSA-h8jm-2x53-xhp5","RUSTSEC-2022-0065"],"provenance":"source"}],"advisories":[{"id":"GHSA-h8jm-2x53-xhp5","url":"https://github.com/advisories/GHSA-h8jm-2x53-xhp5","severity":"HIGH","ecosystem":"crates.io","package":"openssl-src","vulnerableRanges":[">=300.0.0, <300.0.11"],"patched":["300.0.11"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-7358","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7358","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-01-11","earliestUrl":"https://github.com/WhatTheFuzz/openssl-fuzz","repos":[{"name":"WhatTheFuzz/openssl-fuzz","url":"https://github.com/WhatTheFuzz/openssl-fuzz","stars":5,"created":"2023-01-11"}]},"first":{"date":"2023-01-11","source":"PoC-in-GitHub","url":"https://github.com/WhatTheFuzz/openssl-fuzz"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html"],"flow":[],"timeline":[{"date":"2022-11-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-3786","provenance":"source"},{"date":"2023-01-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/WhatTheFuzz/openssl-fuzz","provenance":"source"}],"speed":{"daysToPublicExploit":71,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":33.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 advisory exploit reference; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2022-2274","published":"2022-07-01","fixed":"300.0.9","kev":false},{"cve":"CVE-2022-3358","published":"2022-10-11","fixed":"300.0.10","kev":false,"link":{"from":"CVE-2022-3358","to":"CVE-2022-3786","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"crates.io:openssl-src","fromFixed":"300.0.10","toFixed":"300.0.11","daysApart":21}]}},{"cve":"CVE-2022-3602","published":"2022-11-01","fixed":"300.0.11","kev":false},{"cve":"CVE-2022-3786","published":"2022-11-01","fixed":"300.0.11","kev":false},{"cve":"CVE-2022-3996","published":"2022-12-13","fixed":"300.0.12","kev":false},{"cve":"CVE-2022-4203","published":"2023-02-24","fixed":"300.0.12","kev":false},{"cve":"CVE-2022-4304","published":"2023-02-08","fixed":"300.0.12","kev":false}],"package":"crates.io:openssl-src"}}