What’s Vulnerable › Vulnerabilities

CVE-2022-3143

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-13 · updated 2026-06-17
• Weakness: CWE-203

Description

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.

Affected products

• Red Hat JBoss EAP: 7.0.0
• RedHat Wildfly Elytron: 1.15.15

References

• https://access.redhat.com/security/cve/CVE-2022-3143
• https://access.redhat.com/security/cve/CVE-2022-3143

Get alerted when CVE-2022-3143 or the next vulnerability affects your stack