CVE-2022-1259
published 2022-08-31CVE-2022-1259: A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the…
PriorityP335high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.07%
61.1th percentile
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| auth0 | jsonwebtoken | >= 0 < 9.0.0 | 9.0.0 |
| debian | undertow | — | — |
| msrc | cbl2_nmi_1.8.11-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_nmi_1.8.17-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | single_sign-on | — | — |
| redhat | undertow | <= 2.2.17 | — |
| redhat | undertow | — | — |
| redhat | undertow | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
vendor_msrc5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
ghsa·2022-12-22
CVE-2022-23541 [MEDIUM] CWE-1259 jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
# Overview
Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens.
# Am I affecte
GHSA
GHSA-5837-3xvj-5g8r: A flaw was found in Undertow
ghsa_unreviewed·2022-09-01·CVSS 5.9
CVE-2022-1259 [MEDIUM] CWE-400 GHSA-5837-3xvj-5g8r: A flaw was found in Undertow
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
OSV
CVE-2022-1259: A flaw was found in Undertow
osv·2022-08-31·CVSS 5.9
CVE-2022-1259 [MEDIUM] CVE-2022-1259: A flaw was found in Undertow
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
Red Hat
kernel: net: hns: fix possible memory leak in hnae_ae_register()
vendor_redhat·2025-09-16·CVSS 5.5
CVE-2022-50352 [MEDIUM] CWE-772 kernel: net: hns: fix possible memory leak in hnae_ae_register()
kernel: net: hns: fix possible memory leak in hnae_ae_register()
In the Linux kernel, the following vulnerability has been resolved:
net: hns: fix possible memory leak in hnae_ae_register()
Inject fault while probing module, if device_register() fails,
but the refcount of kobject is not decreased to 0, the name
allocated in dev_set_name() is leaked. Fix this by calling
put_device(), so that name can be freed in callback function
kobject_cleanup().
unreferenced object 0xffff00c01aba2100 (size 128):
comm "systemd-udevd", pid 1259, jiffies 4294903284 (age 294.152s)
hex dump (first 32 bytes):
68 6e 61 65 30 00 00 00 18 21 ba 1a c0 00 ff ff hnae0....!......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[] slab_post_alloc_hook+0xa0/0x3e0
[] __kmem_cache_alloc_node+
Microsoft
AAD Pod Identity obtaining token with backslash
vendor_msrc·2022-12-13·CVSS 5.3
CVE-2022-23551 [MEDIUM] CWE-1259 AAD Pod Identity obtaining token with backslash
AAD Pod Identity obtaining token with backslash
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.m
Red Hat
undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
vendor_redhat·2022-04-06·CVSS 5.9
CVE-2022-1259 [MEDIUM] CWE-400 undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.
Statement: This flaw occurs because of an incomplete fix for CVE-2021-3629.
Package: undertow (Red Hat build of Quarkus) - Will not fix
Package: undertow (Red Hat Decision Manager 7) - Not affected
Package: undertow (Red Hat Integration Camel K 1) - Fix deferred
Package: undertow (R
Debian
CVE-2022-1259: undertow - A flaw was found in Undertow. A potential security issue in flow control handlin...
vendor_debian·2022·CVSS 5.9
CVE-2022-1259 [MEDIUM] CVE-2022-1259: undertow - A flaw was found in Undertow. A potential security issue in flow control handlin...
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
https://access.redhat.com/security/cve/CVE-2022-1259https://bugzilla.redhat.com/show_bug.cgi?id=2072339https://security.netapp.com/advisory/ntap-20221014-0006/https://access.redhat.com/security/cve/CVE-2022-1259https://bugzilla.redhat.com/show_bug.cgi?id=2072339https://security.netapp.com/advisory/ntap-20221014-0006/
2022-08-31
Published