CVE-2022-25888

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-25896.1Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.CVE-2022-258909.8All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.CVE-2022-258917.5The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage fun CVE-2022-258927.5The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) wh CVE-2022-258939.8The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set CVE-2022-258949.8All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via je CVE-2022-258957.5All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed CVE-2022-258964.8This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.CVE-2022-258977.5The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive CVE-2022-258989.8The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non B CVE-2022-258999.8Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenti CVE-2022-25907.0A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shar