Vulnerability-Lookup

CVE-2022-3638 (GCVE-0-2022-3638)

Vulnerability from cvelistv5 – Published: – Updated: 2022-11-09 00:00

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2022-11-09T00:00:00",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2022-3638",
    "dateRejected": "2022-11-09T00:00:00",
    "dateReserved": "2022-10-21T00:00:00",
    "dateUpdated": "2022-11-09T00:00:00",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\"}]",
      "id": "CVE-2022-3638",
      "lastModified": "2023-11-07T03:51:33.890",
      "published": "2022-10-21T11:15:09.773",
      "sourceIdentifier": "cna@vuldb.com",
      "vulnStatus": "Rejected"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-3638\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2022-10-21T11:15:09.773\",\"lastModified\":\"2023-11-07T03:51:33.890\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\"}],\"metrics\":{},\"references\":[]}}"
  }
}

cleanstart-2026-zt77083

Vulnerability from cleanstart

Published

2026-02-18 00:40

Modified

2026-02-17 14:16

Summary

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers

Details

Multiple security vulnerabilities affect the nginx package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. See references for individual vulnerability details.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "nginx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the nginx package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-ZT77083",
  "modified": "2026-02-17T14:16:07Z",
  "published": "2026-02-18T00:40:43.959662Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZT77083.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2017-7529"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2018-16845"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-20372"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-9511"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-9513"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2019-9516"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-23017"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-46461"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-46462"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-46463"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-25139"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-3638"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-41741"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-41742"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-31079"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-32760"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-34161"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-35200"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-7347"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-23419"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7529"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16845"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20372"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23017"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46461"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46462"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46463"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25139"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3638"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41741"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41742"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31079"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32760"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34161"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35200"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7347"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23419"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers",
  "upstream": [
    "CVE-2017-7529",
    "CVE-2018-16845",
    "CVE-2019-20372",
    "CVE-2019-9511",
    "CVE-2019-9513",
    "CVE-2019-9516",
    "CVE-2021-23017",
    "CVE-2021-46461",
    "CVE-2021-46462",
    "CVE-2021-46463",
    "CVE-2022-25139",
    "CVE-2022-3638",
    "CVE-2022-41741",
    "CVE-2022-41742",
    "CVE-2023-44487",
    "CVE-2024-31079",
    "CVE-2024-32760",
    "CVE-2024-34161",
    "CVE-2024-35200",
    "CVE-2024-7347",
    "CVE-2025-23419"
  ]
}

GHSA-WX2J-C4F3-F6H4

Vulnerability from github – Published: 2022-10-21 12:00 – Updated: 2022-10-24 19:00

Details

A vulnerability was found in Nginx and classified as problematic. This issue affects some unknown processing of the file ngx_resolver.c of the component IPv4 Off Handler. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211937 was assigned to this vulnerability.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-3638"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-21T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was found in Nginx and classified as problematic. This issue affects some unknown processing of the file ngx_resolver.c of the component IPv4 Off Handler. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211937 was assigned to this vulnerability.",
  "id": "GHSA-wx2j-c4f3-f6h4",
  "modified": "2022-10-24T19:00:16Z",
  "published": "2022-10-21T12:00:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3638"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nginx/nginx/commit/14341ce2377d38a268261e0fec65b6915ae6e95e"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.211937"
    },
    {
      "type": "WEB",
      "url": "http://hg.nginx.org/nginx/rev/0422365794f7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2022-3638

Vulnerability from fkie_nvd - Published: 2022-10-21 11:15 - Updated: 2023-11-07 03:51

Severity ?

Summary

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
    }
  ],
  "id": "CVE-2022-3638",
  "lastModified": "2023-11-07T03:51:33.890",
  "metrics": {},
  "published": "2022-10-21T11:15:09.773",
  "references": [],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Rejected"
}

GSD-2022-3638

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Aliases

CVE-2022-3638

Aliases

CVE-2022-3638

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-3638",
    "id": "GSD-2022-3638",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-3638.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-3638"
      ],
      "details": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
      "id": "GSD-2022-3638",
      "modified": "2023-12-13T01:19:40.066647Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2022-3638",
        "STATE": "REJECT"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.23.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@vuldb.com",
          "ID": "CVE-2022-3638"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability was found in Nginx and classified as problematic. This issue affects some unknown processing of the file ngx_resolver.c of the component IPv4 Off Handler. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211937 was assigned to this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-401"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "N/A",
              "refsource": "N/A",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://vuldb.com/?id.211937"
            },
            {
              "name": "N/A",
              "refsource": "N/A",
              "tags": [
                "Mailing List",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://hg.nginx.org/nginx/rev/0422365794f7"
            },
            {
              "name": "N/A",
              "refsource": "N/A",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/nginx/nginx/commit/14341ce2377d38a268261e0fec65b6915ae6e95e"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-10-24T18:55Z",
      "publishedDate": "2022-10-21T11:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-3638 (GCVE-0-2022-3638)

cleanstart-2026-zt77083

Vulnerability from cleanstart

GHSA-WX2J-C4F3-F6H4

FKIE_CVE-2022-3638

GSD-2022-3638

Tags

Sightings

Nomenclature