CVE-2022-38493

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-20 · updated 2026-06-17
Weakness: CWE-327

Description

Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

Affected products

Rhonabwy Project Rhonabwy: from 0.9.99 before 1.1.6 — fixed in 1.1.6

How to fix

Upgrade to a fixed version: Rhonabwy Project Rhonabwy 1.1.6. Check the vendor advisory for mitigations.

References

https://github.com/babelouest/rhonabwy/commit/dd528b3aabd13863f855a68e76966e4e019fc399
https://github.com/babelouest/rhonabwy/commit/dd528b3aabd13863f855a68e76966e4e019fc399

Get alerted when CVE-2022-38493 or the next vulnerability affects your stack