CVE-2022-2809

    Dashboard / Vulnerabilities / CVE-2022-2809

    CVE-2022-2809

    Published: 27 Oct 2022Last Modified: 24 Oct 2026

    Summary:

    Details: A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.

    References: https://github.com/openbmc/bmcweb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f5a72daa5d11cb78f082c2df7ca4a2d62c67a444
    Fixed -None

    Affected versions

    2.13.0-dev

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-2809 | CVE-DB