CVE-2022-37454

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-21 · updated 2026-10-14
Weakness: CWE-190

Description

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Affected products

Debian Linux: 10.0, 11.0
Extended Keccak Code Package Project Extended Keccak Code Package: all versions
Fedoraproject Fedora: 35, 36
PHP: from 7.2.0 before 7.4.33; from 8.0.0 before 8.0.25; from 8.1.0 before 8.1.12 — fixed in 7.4.33, 8.0.25, 8.1.12
PyPy: from 7.0.0
Pysha3 Project Pysha3: all versions
Python: from 3.6.0 before 3.7.16; from 3.8.0 before 3.8.16; from 3.9.0 before 3.9.16; from 3.10.0 before 3.10.9 — fixed in 3.10.9, 3.7.16, 3.8.16, 3.9.16
Sha3 Project Sha3: before 1.0.5 — fixed in 1.0.5

How to fix

Upgrade to a fixed version: PHP 7.4.33, 8.0.25, 8.1.12; Python 3.10.9, 3.7.16, 3.8.16, 3.9.16; Sha3 Project Sha3 1.0.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-37454 or the next vulnerability affects your stack