CVE-2022-21230

This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to be viewed by all users on the host machine. **Workaround:** Manually specifying the -Djava.io.tmpdir= argument when launching Java to set the temporary directory to a directory exclusively controlled by the current user can fix this issue.

• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-2r85-x9cf-8fcgThird Party Advisory
• https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/core/src/main/java/org/nanohttpd/protocols/http/tempfiles/DefaultTempFile.java%23L58Broken Link
• https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/core/src/main/java/org/nanohttpd/protocols/http/tempfiles/DefaultTempFileManager.java%23L60Broken Link
• https://snyk.io/vuln/SNYK-JAVA-ORGNANOHTTPD-2422798Third Party Advisory
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-2r85-x9cf-8fcgThird Party Advisory
• https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/core/src/main/java/org/nanohttpd/protocols/http/tempfiles/DefaultTempFile.java%23L58Broken Link
• https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/core/src/main/java/org/nanohttpd/protocols/http/tempfiles/DefaultTempFileManager.java%23L60Broken Link
• https://snyk.io/vuln/SNYK-JAVA-ORGNANOHTTPD-2422798Third Party Advisory

Published

May 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21225Improper neutralization in the Intel(R) Data Center Manager …8
• CVE-2022-21226Out-of-bounds read in the Intel(R) Trace Analyzer and Collec…5.5
• CVE-2022-21227The package sqlite3 before 5.0.3 are vulnerable to Denial of…7.5
• CVE-2022-21228The affected product is vulnerable to a stack-based buffer o…7.8
• CVE-2022-21229Improper buffer restrictions for some Intel(R) NUC 9 Extreme…7.8
• CVE-2022-2123The WP Opt-in WordPress plugin through 1.4.1 is vulnerable t…4.3
• CVE-2022-21231All versions of package deep-get-set are vulnerable to Proto…9.8
• CVE-2022-21233Improper isolation of shared resources in some Intel(R) Proc…5.5
• CVE-2022-21234An SQL injection vulnerability exists in the EchoAssets.aspx…8.8
• CVE-2022-21235The package github.com/masterminds/vcs before 1.13.3 are vul…9.8
• CVE-2022-21236An information disclosure vulnerability exists due to a web …7.5
• CVE-2022-21237Improper buffer access in firmware for some Intel(R) NUCs ma…6.7