CVE-2022-37434

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 19.24%
EPSS Percentile: 97.33%
CISA KEV: Not listed

Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 05-Aug-2022 14:15
Last Modified: 15-Oct-2026 01:17
EPSS Date: 2026-10-23
CWE: CWE-787, CWE-120

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

zlib / zlib
Version / affected range: * · through (inclusive) 1.2.12
cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
debian / debian_linux
Version / affected range: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
netapp / hci
Version / affected range: -
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
netapp / management_services_for_element_software
Version / affected range: -
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
netapp / oncommand_workflow_automation
Version / affected range: -
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
netapp / ontap_select_deploy_administration_utility
Version / affected range: -
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
netapp / storagegrid
Version / affected range: -
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
netapp / hci_compute_node
Version / affected range: -
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
netapp / h300s_firmware
Version / affected range: -
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
netapp / h500s_firmware
Version / affected range: -
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
netapp / h700s_firmware
Version / affected range: -
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
apple / ipados
Version / affected range: * · before (exclusive) 15.7.1
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
apple / iphone_os
Version / affected range: * · before (exclusive) 15.7.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
apple / iphone_os
Version / affected range: * · from (inclusive) 16.0 · before (exclusive) 16.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
apple / macos
Version / affected range: * · from (inclusive) 11.0 · before (exclusive) 11.7.1
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
apple / macos
Version / affected range: * · from (inclusive) 12.0.0 · before (exclusive) 12.6.1
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
apple / watchos
Version / affected range: * · before (exclusive) 9.1
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
stormshield / stormshield_network_security
Version / affected range: * · from (inclusive) 3.7.31 · before (exclusive) 3.7.34
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
stormshield / stormshield_network_security
Version / affected range: * · from (inclusive) 3.11.0 · before (exclusive) 3.11.22
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
stormshield / stormshield_network_security
Version / affected range: * · from (inclusive) 4.3.0 · before (exclusive) 4.3.16
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
stormshield / stormshield_network_security
Version / affected range: * · from (inclusive) 4.6.0 · before (exclusive) 4.6.3
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*

References

Last enrichment sync: 24-Oct-2026 21:22
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

SSRF), CVE-2025-29927 (Next.js authentication bypass), CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2022-37434 (zlib heap overflow, EPSS 0.92). AWS Adds Five Risk Indicators to GuardDuty Extended Threat Detection

CVE (6)

MITRE ATT&CK (1)

Vendors (1)

Products (8)

Tools (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.