Skip to content
Fencer Intel
high 7.5

CVE-2022-31394 json

Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing…

published 3y ago modified 3mo ago also EUVD-2022-52907 , JLSEC-2026-20

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.

Patch / fix

  • julia hyper_jll 0.14.19+0
  • hyper hyper 0.14.19
  • rust-hyper Debian 14, Debian 13, Debian 12 0.14.19-1

debian advisories DEBIAN-CVE-2022-31394

  • gstreamer-plugins-rs SLE Real Time 15 SP4, SLE Module for Desktop Applications 15 SP5 0.8.2-150400.3.3.1
  • sccache SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 0.4.2~3-150400.3.3.1
  • sccache SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +4 more 0.4.1~18-150300.7.12.1
  • rustup SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.26.0~0-150400.3.7.1
  • aws-nitro-enclaves-cli SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 1.2.2~git0.4ccc639-150400.3.3.1

suse advisories SUSE-SU-2024:0090-1SUSE-SU-2023:3526-1SUSE-SU-2023:2637-1SUSE-SU-2023:2603-1SUSE-SU-2023:1844-1

  • rustup openSUSE Tumbleweed 1.25.2~0-2.1
  • sccache openSUSE Tumbleweed 0.4.0pre.7~0-2.1
  • pijul openSUSE Tumbleweed 1.0.0~beta.4-1.1
  • wasm-pack openSUSE Tumbleweed 0.11.0~0-1.1

opensuse advisories openSUSE-SU-2024:12727-1openSUSE-SU-2024:12728-1openSUSE-SU-2024:12764-1openSUSE-SU-2024:12807-1

  • rpm-ostree CBL-Mariner 2.0 2022.1-4
  • rpm-ostree Azure Linux 3.0 2022.1-7
  • rust Azure Linux 3.0 hyper-0.14.25

azure linux advisories AZL-13685AZL-35218AZL-61516

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-31394 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
last yr.

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/hyperium/hyper/issues/2826 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
julia hyper_jll
<0.14.19+0
0.14.19+0

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.