CVE-2022-32149

Aliases:GHSA-69ch-w2m2-3vjpGO-2022-1059RHSA-2024:1994DEBIAN-CVE-2022-32149CGA-2f8x-r662-j7grCGA-33rj-x63v-v35wCGA-344f-5cfc-wj76CGA-393j-c2q2-mcmmCGA-3c8f-q9g8-523pCGA-3xqg-q789-2749CGA-4h4g-3f96-6r4gCGA-5pm5-9jw9-cjj2CGA-69g2-9r5p-x98jCGA-6fx9-3p56-95x2CGA-7w4g-845m-x5mhCGA-826r-q38m-r2h5CGA-8v29-v4fj-48h4CGA-8wvg-8hjr-jwfhCGA-9433-4p48-rwm9CGA-959g-hqcc-q92pCGA-cv32-4cx6-wqcfCGA-f48r-vp9r-vm7hCGA-ffj3-qxpm-w53qCGA-fmp4-vw74-9c6pCGA-g4qv-w5mq-m3jqCGA-g6wx-ff2c-rf7hCGA-g997-v4c6-579jCGA-h3g6-jrv2-4g93CGA-hrjm-hpxp-rgp6CGA-jgqc-xqpm-95xvCGA-m4xr-pp5m-27qwCGA-m5vg-5mff-vmm3CGA-m74m-4hpg-v867CGA-m7jj-jh8f-898xCGA-prqp-fch2-9ph2CGA-23hq-cpxh-vm84CGA-28q8-r92r-cpx3CGA-2r2p-rx7c-xjc2CGA-3jp7-75mg-7rx7CGA-4q7p-7h8m-x4jxCGA-4qcf-q73g-9gm4CGA-5368-7f8j-c4x2CGA-62gj-5488-r8gjCGA-6pf8-mq5w-mxp5CGA-7g6j-v3gm-88gmCGA-84hw-j39h-3629CGA-95xj-6h65-xpvvCGA-g7jj-c48h-phgjCGA-gjgv-r7p5-4r57CGA-h7rg-9q5w-whx9CGA-hr5j-qg45-3mjjCGA-j984-7h3f-pq5hCGA-m64x-w4rq-ww27CGA-pcxp-59fx-mwv8CGA-pj95-gqx9-p8w9CGA-pm89-wg23-h7jcCGA-pq2x-mfxh-f6wcCGA-pv72-pj55-7jjqCGA-px75-5hv2-vrxqCGA-q59j-46p9-4x6xCGA-q867-84c8-xw24CGA-q8f7-r5cr-577mCGA-q9rm-8wvc-x9gwCGA-qfr8-44gj-wr2hCGA-qjq8-hx86-72w3CGA-qp72-229h-w8r9CGA-qxv7-2fgw-5wrqCGA-r2v8-v6mx-7x84CGA-r5hr-qq8c-xp4xCGA-r6hq-q7jm-rgj6CGA-r8qr-jpm2-jg8jCGA-rpg8-m699-pcvfCGA-rv7f-jgxf-p5c5CGA-rwq6-vcfc-pr36CGA-v7hp-43cv-qc7hCGA-vf45-4vcv-7p3gCGA-vg8x-mc92-38rjCGA-vp95-w6vh-9g5hCGA-vrv6-8c8c-3vpxCGA-w5jg-m3hw-xpqvCGA-wj9v-8v45-cv7vCGA-wr3f-pfc6-2pgwCGA-x6hv-r87j-8jx3CGA-x76v-jrh5-548pCGA-xq2w-699c-mjjfCGA-xxhv-fwm7-h9fr
Advisory lineage Upstream: 0 Downstream: 20
Modified
Published: 14 Oct 2022, 00:00
Last modified:15 May 2025, 20:35

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.55% LOW
2% probability +1.50%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Oct 2022, 00:00
Published
Vulnerability first disclosed
15 May 2025, 20:35
Last Modified
Vulnerability information updated

Description

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.55%• Percentile: 74%

Techniques & Countermeasures

  • CWE-772•Missing Release of Resource after Effective Lifetime

    The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Affected Systems

  • chainguard•dex-k8s-authenticator

    < 0

  • chainguard•dynamic-localpv-provisioner

    < 3.4.1-r3

  • chainguard•dynamic-localpv-provisioner-fips

    < 3.5.0-r0

  • chainguard•gitleaks

    < 8.18.2-r1

  • chainguard•grpcurl

    < 1.8.7-r7

  • chainguard•hey

    < 0.1.4-r3

  • chainguard•k3d

    < 5.6.0-r11

  • chainguard•k3d-proxy

    < 5.6.0-r11

  • chainguard•k3d-tools

    < 5.6.0-r11

  • chainguard•kube-state-metrics-2.6

    < 2.6.0-r1

  • chainguard•kubeflow

    < 1.10.0-r2

  • chainguard•kubeflow-access-management

    < 1.10.0-r2

  • chainguard•kubeflow-access-management-compat

    < 1.10.0-r2

  • chainguard•kubeflow-access-management-fips

    < 1.10.0-r2

  • chainguard•kubeflow-access-management-fips-compat

    < 1.10.0-r2

  • chainguard•kubeflow-admission-webhook

    < 1.10.0-r2

  • chainguard•kubeflow-admission-webhook-compat

    < 1.10.0-r2

  • chainguard•kubeflow-admission-webhook-fips

    < 1.10.0-r2

  • chainguard•kubeflow-admission-webhook-fips-compat

    < 1.10.0-r2

  • chainguard•kubeflow-fips

    < 1.10.0-r2

  • chainguard•kubeflow-notebook-controller

    < 1.10.0-r2

  • chainguard•kubeflow-notebook-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-notebook-controller-fips

    < 1.10.0-r2

  • chainguard•kubeflow-notebook-controller-fips-compat

    < 1.10.0-r2

  • chainguard•kubeflow-profile-controller

    < 1.10.0-r2

  • chainguard•kubeflow-profile-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-profile-controller-fips

    < 1.10.0-r2

  • chainguard•kubeflow-profile-controller-fips-compat

    < 1.10.0-r2

  • chainguard•kubeflow-pvcviewer-controller

    < 1.10.0-r2

  • chainguard•kubeflow-pvcviewer-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-pvcviewer-controller-fips

    < 1.10.0-r2

  • chainguard•kubeflow-pvcviewer-controller-fips-compat

    < 1.10.0-r2

  • chainguard•kubeflow-tensorboard-controller

    < 1.10.0-r2

  • chainguard•kubeflow-tensorboard-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-tensorboard-controller-fips

    < 1.10.0-r2

  • chainguard•kubeflow-tensorboard-controller-fips-compat

    < 1.10.0-r2

  • chainguard•php-fpm_exporter

    < 2.2.0-r8

  • chainguard•prometheus-postgres-exporter-0.10

    < 0

  • chainguard•terraform-provider-sendgrid

    < 1.0.1-r1

  • chainguard•terraform-provider-sendgrid-fips

    < 1.0.1-r1

  • chainguard•vt-cli

    < 1.0.0-r3

  • wolfi•dynamic-localpv-provisioner

    < 3.4.1-r3

  • wolfi•gitleaks

    < 8.18.2-r1

  • wolfi•grpcurl

    < 1.8.7-r7

  • wolfi•hey

    < 0.1.4-r3

  • wolfi•k3d

    < 5.6.0-r11

  • wolfi•k3d-proxy

    < 5.6.0-r11

  • wolfi•k3d-tools

    < 5.6.0-r11

  • wolfi•kubeflow

    < 1.10.0-r2

  • wolfi•kubeflow-access-management

    < 1.10.0-r2

Showing first 50 affected entries in server-rendered view.

References (20)