CVE-2022-25906 HIGH

CVE-2022-25906

Vendor N/A

Product is-http2

Weakness CWE-78

Published February 1, 2023

Last update March 26, 2025

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Local

Attack complexity High

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

What the vulnerability does

01Description

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.

Key dates

02Disclosure timeline

February 1, 2023 CVE published

March 26, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-25906 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/78.html

Related vulnerabilities

CVE-2022-25906

01Description

02Disclosure timeline

03References

04Related CVE