CVE-2022-38177

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

• CWE-401
• CWE-401

• http://www.openwall.com/lists/oss-security/2022/09/21/3Mailing List, Patch, Third Party Advisory
• https://kb.isc.org/docs/cve-2022-38177Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00007.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
• https://security.gentoo.org/glsa/202210-25Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221228-0010/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5235Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/21/3Mailing List, Patch, Third Party Advisory
• https://kb.isc.org/docs/cve-2022-38177Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00007.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
• https://security.gentoo.org/glsa/202210-25Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221228-0010/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5235Third Party Advisory

Published

Sep 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38168Broken Access Control in User Authentication in Avaya Scopia…9.1
• CVE-2022-3817A vulnerability has been found in Axiomatic Bento4 and class…6.5
• CVE-2022-38170In Apache Airflow prior to 2.3.4, an insecure umask was conf…4.7
• CVE-2022-38171Xpdf prior to version 4.04 contains an integer overflow in t…7.8
• CVE-2022-38172ServiceNow through San Diego Patch 3 allows XSS via the name…6.1
• CVE-2022-38176An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Inco…7.8
• CVE-2022-38178By spoofing the target resolver with responses that have a m…7.5
• CVE-2022-38179JetBrains Ktor before 2.1.0 was vulnerable to the Reflect Fi…6.1
• CVE-2022-3818An uncontrolled resource consumption issue when parsing URLs…5.3
• CVE-2022-38180In JetBrains Ktor before 2.1.0 the wrong authentication prov…6.5
• CVE-2022-38181The Arm Mali GPU kernel driver allows unprivileged users to …8.8
• CVE-2022-38183In Gitea before 1.16.9, it was possible for users to add exi…6.5