CVE-2022-43357 Denial of service in n/a

High 7.5 Published 22 Aug 2023 Updated 3 Oct 2024

Attackers can cause a denial of service in libsass via a stack overflow in the Sass compiler.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-43357?

CVE-2022-43357 is a high-severity denial of service vulnerability in n/a, published on 22 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2.

Weakness: CWE-787

Which versions are affected by CVE-2022-43357?

1 open source package ship an affected version, including sass. It affects 2 products.

Package	Affected	Fixed in
`sass` Bitnami	From `3.6.5-8-g210218`	`3.6.5`

Products include Sass-Lang Libsass, Sass-Lang Sassc.

How do I fix CVE-2022-43357?

Upgrade sass to 3.6.5 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-43357 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-43357 exists.

Sources

Also known as AZL-43714, AZL-44079, BIT-sass-2022-43357, DEBIAN-CVE-2022-43357, GHSA-j7vr-2gc9-mmv7, JLSEC-2026-664 and 1 more.