CVE-2022-21716

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Mar 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-217185.0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to CVE-2022-217196.1GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. CVE-2022-21724.3The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change se CVE-2022-217204.9GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally i CVE-2022-217217.5Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a CVE-2022-217229.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217239.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217249.8pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security rese CVE-2022-217256.5Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a CVE-2022-217268.8Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and CVE-2022-217278.8Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer CVE-2022-217288.1Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate