CVE-2022-21952: SUMA unauthenticated remote DoS via resource exhaustion

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-22 · updated 2026-07-07
Weakness: CWE-306

Description

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

Affected products

SUSE Manager Server: from 4.1 before 4.1.46; from 4.2 before 4.2.37 — fixed in 4.1.46, 4.2.37

How to fix

Upgrade to a fixed version: SUSE Manager Server 4.1.46, 4.2.37. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21952 or the next vulnerability affects your stack