CVE-2022-24381

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-243826.7Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via l CVE-2022-243837.8The affected product is vulnerable to an out-of-bounds read, which may result in code execution CVE-2022-243846.1Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.CVE-2022-243856.5A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTr CVE-2022-243866.1Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.CVE-2022-243877.2With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsetti CVE-2022-243888.8Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and CVE-2022-243898.8Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Netwo CVE-2022-24397.2The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted i CVE-2022-243908.8Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis CVE-2022-243918.8Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level ac CVE-2022-243928.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed