CVE-2022-31628: phar wrapper can occur dos when using quine gzip file
Vulnerability summary
CVE-2022-31628 is a medium (CVSS 5.5) Uncontrolled Recursion vulnerability in debian debian_linux. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 50.1% of scored vulnerabilities.
Not severe (CVSS 2.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 16 · Related 9Timeline
- 28-09-2022PublishedVulnerability first disclosed.
- 20-05-2025Last modifiedVulnerability information updated.
Description
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA2.3LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.63% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
- CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu5 products
- php5All versions (No fix recorded)
- php7.0< 7.0.33-0ubuntu0.16.04.16+esm5
- php7.2< 7.2.24-0ubuntu0.18.04.15
- php7.4< 7.4.3-4ubuntu2.15
- php8.1< 8.1.2-1ubuntu2.8
Alpine3 products
- php7< 7.4.32-r0
- php8< 8.0.24-r0 | < 8.0.25-r0
- php81< 8.1.11-r0
Debian2 products
- php7.4< 7.4.33-1+deb11u1
- debian_linuxEOL10.0 | 11.0
Opensuse2 products
- php7&distro=openSUSE Tumbleweed< 7.4.32-1.1
- php8&distro=openSUSE Tumbleweed< 8.1.11-1.1
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Php1 product
- php< 7.4.31 | ≥ 8.0.0, < 8.0.24 | ≥ 8.1.0, < 8.1.11
Php group1 product
- php≥ 7.4.X, < 7.4.31 | ≥ 8.0.X, < 8.0.24 | ≥ 8.1.X, < 8.1.11
7 vendors · 15 products
References
18 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.netapp.com/advisory/ntap-20221209-0001/Third Party Advisory
