CVE-2022-25761

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-257628.6If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5 CVE-2022-257637.5Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache CVE-2022-257659.8The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.CVE-2022-257668.8The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api CVE-2022-257679.8All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database ser CVE-2022-257686.5The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform th CVE-2022-257699.1ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the roo CVE-2022-25778.8A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. This vulnerability affects unknown code of CVE-2022-257707.5Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulner CVE-2022-257726.1A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable CVE-2022-257735.4This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * CVE-2022-257745.4Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. User