GHSA-v5w6-wcm8-jm4q · Severity: high · Ecosystem: rust — openssl-src contains Double free after calling `PEM_read_bio_ex`
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.
Conclusion & alert: CVE-2022-4450 is rated High Risk (69/100): CVSS High severity, with high exploitation likelihood (EPSS 20.44%, 97th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +20.33% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.12% | 20.44% | +20.33% |
| 2 | 2025-11-21 | 1.52% | 0.12% | -1.40% |
| 3 | 2025-11-18 | — | 1.52% | — |
Full EPSS history (10 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
GHSA-v5w6-wcm8-jm4q · Severity: high · Ecosystem: rust — openssl-src contains Double free after calling `PEM_read_bio_ex`
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2022-4450: 2 source package rows (openssl, openssl1.1-compat); 93 state rows across 10 repos (3.17-community, 3.17-main, 3.18-community, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-community, edge-main); fixed 10, open 83. | https://security.alpinelinux.org/vuln/CVE-2022-4450 |
debian
|
not yet assigned | CVE-2022-4450 not yet assigned priority: Debian including 1 source packages (openssl), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2022-4450 |
gentoo
|
normal | CVE-2022-4450: 1 GLSA(s) (202402-08), 1 atom(s) (dev-libs/openssl); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2022-4450 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2022-4450 |
suse
|
medium | CVE-2022-4450 severity moderate: SUSE including 525 source package names (0.23.0.3.2.368:libopenssl1_1-1.1.1d-150200.11.57.1, 0.23.0.3.2.368:libopenssl1_1-hmac-1.1.1d-150200.11.57.1, …), 1166 product×package rows across 251 product lines (Container bci/bci-init, Container bci/dotnet-aspnet, … (251 product lines)): Fixed 834, Known Not Affected 203, Known Affected 129. | https://www.suse.com/security/cve/CVE-2022-4450/ |
ubuntu
|
medium | CVE-2022-4450 medium priority: Ubuntu including 4 source packages (edk2, nodejs, openssl, openssl1.0), 46 status rows across 13 suites (bionic, focal, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 19, released 13, needs-triage 6, DNE 5, ignored 3. | https://ubuntu.com/security/CVE-2022-4450 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| openssl | openssl | >= 1.1.1, < 1.1.1t | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| openssl | openssl | >= 3.0.0, < 3.0.8 | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| stormshield | stormshield_network_security | >= 4.0.0, < 4.3.16 | cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* |
| stormshield | stormshield_network_security | >= 4.4.0, < 4.6.3 | cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* |