CVE-2022-31026: Use of Uninitialized Variable in trilogy

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-09 · updated 2026-06-17
Weakness: CWE-908

Description

Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.

Affected products

github trilogy: before 2.1.1 — fixed in 2.1.1

How to fix

Upgrade to a fixed version: github trilogy 2.1.1. Check the vendor advisory for mitigations.

References

https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a962
https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfm
https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a962
https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfm

Get alerted when CVE-2022-31026 or the next vulnerability affects your stack