CVE-2022-31628

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674CWE-835

Affected software

VendorProductVersions
PHP GroupPHP>= 7.4.X, < 7.4.31; >= 8.0.X, < 8.0.24; >= 8.1.X, < 8.1.11

References

Timeline

Published
Sep 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-316296.5In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookiCVE-2022-316307.1In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a speciallCVE-2022-316319.1In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data foCVE-2022-316357.8Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allCVE-2022-316367.8Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allCVE-2022-316377.8Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allCVE-2022-316387.8Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allCVE-2022-316397.8Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allCVE-2022-316407.0Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escCVE-2022-316417.0Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escCVE-2022-316427.0Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escCVE-2022-316435.5A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP i
CVE-2022-31628: Medium severity, CVSS 5.5 | Vulnix