CVE-2022-3996 X.509 Policy Constraints Double Locking

What is CVE-2022-3996?

CVE-2022-3996 is a high-severity denial of service vulnerability in Openssl Openssl, published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup.

Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.

Weakness: CWE-667

Which versions are affected by CVE-2022-3996?

2 open source packages ship an affected version, including openssl-src. It affects 1 product.

Products include Openssl Openssl.

How do I fix CVE-2022-3996?

Upgrade openssl-src to 300.0.12 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-3996 being exploited?

There is no known exploitation of CVE-2022-3996 in the wild and no public exploit code.

Other vulnerabilities in Openssl Openssl

• CVE-2009-3245 Null dereference in n/a Critical 10.0
• CVE-2006-3738 Memory corruption in n/a Critical 10.0
• CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation Critical 9.8
• CVE-2016-6309 Use after free in n/a Critical 9.8
• CVE-2016-0799 Integer overflow in n/a Critical 9.8

All Openssl Openssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2022-3996, AZL-40306, CLEANSTART-2026-FU56835, DEBIAN-CVE-2022-3996, GHSA-vr8j-hgmm-jh9r, UBUNTU-CVE-2022-3996 and 1 more.