CVE-2022-23066

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

• CWE-682

• https://blocksecteam.medium.com/how-a-critical-bug-in-solana-network-was-detected-and-timely-patched-a701870e1324Exploit, Third Party Advisory
• https://github.com/solana-labs/rbpf/commit/e61e045f8c244de978401d186dcfd50838817297Patch, Third Party Advisory
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23066Exploit, Third Party Advisory
• https://blocksecteam.medium.com/how-a-critical-bug-in-solana-network-was-detected-and-timely-patched-a701870e1324Exploit, Third Party Advisory
• https://github.com/solana-labs/rbpf/commit/e61e045f8c244de978401d186dcfd50838817297Patch, Third Party Advisory
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23066Exploit, Third Party Advisory

Published

May 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2306Old session tokens can be used to authenticate to the applic…7.5
• CVE-2022-23060A Stored Cross Site Scripting (XSS) vulnerability exists in …4.8
• CVE-2022-23061In Shopizer versions 2.0 to 2.17.0 a regular admin can perma…6.5
• CVE-2022-23063In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insuff…8.8
• CVE-2022-23064In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to…8.8
• CVE-2022-23065In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by S…5.4
• CVE-2022-23067ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token le…8.8
• CVE-2022-23068ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML in…5.4
• CVE-2022-2307A lack of cascading deletes in GitLab CE/EE affecting all ve…3.8
• CVE-2022-23071In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to S…6.5
• CVE-2022-23072In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to S…
• CVE-2022-23073In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to S…