CVE-2022-38667

HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.

• CWE-416

• https://cwe.mitre.org/data/definitions/372.htmlTechnical Description, Third Party Advisory
• https://github.com/0xhebi/CVEs/blob/main/Crow/CVE-2022-38667.mdExploit, Third Party Advisory
• https://github.com/CrowCpp/Crow/pull/524Patch, Third Party Advisory
• https://gynvael.coldwind.pl/?id=753Exploit, Third Party Advisory
• https://cwe.mitre.org/data/definitions/372.htmlTechnical Description, Third Party Advisory
• https://github.com/0xhebi/CVEs/blob/main/Crow/CVE-2022-38667.mdExploit, Third Party Advisory
• https://github.com/CrowCpp/Crow/pull/524Patch, Third Party Advisory
• https://gynvael.coldwind.pl/?id=753Exploit, Third Party Advisory

Published

Aug 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38661HCL Workload Automation could allow a local user to overwrit…7.1
• CVE-2022-38662 In HCL Digital Experience, URLs can be constructed to redir…6.1
• CVE-2022-38663Jenkins Git Plugin 4.11.4 and earlier does not properly mask…6.5
• CVE-2022-38664Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 …5.4
• CVE-2022-38665Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a …6.5
• CVE-2022-38666Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0…7.5
• CVE-2022-38668HTTP applications (servers) based on Crow through 1.0+4 may …7.5
• CVE-2022-38669In soundrecorder service, there is a missing permission chec…7.8
• CVE-2022-3867HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event…4.3
• CVE-2022-38670In soundrecorder service, there is a missing permission chec…7.8
• CVE-2022-38671In camera driver, there is a possible out of bounds write du…5.5
• CVE-2022-38672In face detect driver, there is a possible out of bounds wri…5.5