CVE-2022-41916

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-193

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-419174.3OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when definin CVE-2022-419186.3OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained ac CVE-2022-419198.8Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `P CVE-2022-41928.8Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific CVE-2022-419208.8Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileuti CVE-2022-419214.3Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which c CVE-2022-419229.8`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user CVE-2022-419239.8Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. CVE-2022-419249.6A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, whic CVE-2022-419258.8A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tails CVE-2022-419265.5Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protecte CVE-2022-419277.4XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any conf