CVE-2022-25903 json
Denial of Service (DoS)
published 2022-08-24 4 y ago modified 2026-06-17 4 mo ago also GHSA-hgxq-hcrm-c5pm , EUVD-2022-6567
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.
Patch / fix
- crates.io opcua 0.11.0
- github.com/locka99/opcua#216 commit
- github.com/locka99/opcua#216 pull request
- security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750 advisory
Exploit prediction
1.43% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | opcua | <0.11.0 |
0.11.0 |
Affected products
- n/a opcua
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/locka99/opcua/pull/216
web, third-party-advisory
-
github.com
/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8dd
web, patch, third-party-advisory
-
security.snyk.io
/vuln/SNYK-RUST-OPCUA-2988750
web, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-25903
advisory
-
github.com
/locka99/opcua
package
Sources
- CVE List CVE-2022-25903
- GitHub Advisory GHSA-hgxq-hcrm-c5pm
- NVD CVE-2022-25903
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.