CVE-2022-1473 - CVE House
Back to Database
Status published Unknown CVE-2022-1473

Resource leakage when decoding certificates and keys

Vulnerability Description

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-1473

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Aliaksei Levin

References

More from OpenSSL

View All →
CVE-2025-9232
Out-of-bounds read in HTTP client no_proxy handling
Unknown 0
CVE-2025-9231
Timing side-channel in SM2 algorithm on 64 bit ARM
Unknown 0
CVE-2025-9230
Out-of-bounds read & write in RFC 3211 KEK Unwrap
Unknown 0
CVE-2025-69421
NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
Unknown 0
CVE-2025-69420
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
Unknown 0

Affected Vendor

Affected Software

OpenSSL
Vulnerable Versions:
Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2)

Timeline

Official Publish: May 3rd, 2022
Last Modified: May 5th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.