CVE-2022-46393

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.

• CWE-125
• CWE-787
• CWE-125
• CWE-787

• https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2Release Notes, Third Party Advisory
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0Release Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BR7ZCVKLPGCOEEALUHZMFHXQHR6S4QL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XMKJ5IMJEPXYAHHU56Z4P2FSYIEAESB/
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/Vendor Advisory
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2Release Notes, Third Party Advisory
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0Release Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BR7ZCVKLPGCOEEALUHZMFHXQHR6S4QL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XMKJ5IMJEPXYAHHU56Z4P2FSYIEAESB/
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/Vendor Advisory

Published

Dec 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46383RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 …9.8
• CVE-2022-46387ConEmu through 220807 and Cmder before 1.3.21 report the tit…9.8
• CVE-2022-46389There exists a reflected XSS within the logout functionality…6.1
• CVE-2022-4639A vulnerability, which was classified as critical, has been …9.8
• CVE-2022-46391AWStats 7.x through 7.8 allows XSS in the hostinfo plugin du…6.1
• CVE-2022-46392An issue was discovered in Mbed TLS before 2.28.2 and 3.x be…5.3
• CVE-2022-46394An issue was discovered in the Arm Mali GPU Kernel Driver. A…8.8
• CVE-2022-46395An issue was discovered in the Arm Mali GPU Kernel Driver. A…8.8
• CVE-2022-46396An issue was discovered in the Arm Mali Kernel Driver. A non…3.3
• CVE-2022-46397FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.…7.5
• CVE-2022-46399The Microchip RN4870 module firmware 1.43 (and the Microchip…7.5
• CVE-2022-4640A vulnerability has been found in Mingsoft MCMS 5.2.9 and cl…5.4