# CVE-2022-4450: Double free after calling PEM_read_bio_ex

> An attacker can cause a denial of service by supplying a malicious PEM file that triggers a double free in OpenSSL's PEM parsing functions.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 8 Feb 2023
- **Updated:** 14 Oct 2026
- **Also known as:** ALPINE-CVE-2022-4450, AZL-13347, AZL-13351, AZL-37629, AZL-37892, CLEANSTART-2026-LY01438, DEBIAN-CVE-2022-4450, GHSA-v5w6-wcm8-jm4q, JLSEC-2026-232, OESA-2024-2312, OESA-2024-2313, RUSTSEC-2023-0010, UBUNTU-CVE-2022-4450

## What is CVE-2022-4450?

CVE-2022-4450 is a high-severity use after free vulnerability in Openssl Openssl, published on 8 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around
PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL
functions including PEM_X509_INFO_read_bio_ex() and
SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal
uses of these functions are not vulnerable because the caller does not free the
header argument if PEM_read_bio_ex() returns a failure code. These locations
include the PEM_read_bio_TYPE() functions as well as the decoders introduced in
OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.

Weakness: CWE-415 (Double Free)

## Which versions are affected by CVE-2022-4450?

5 open source packages ship an affected version, including openssl-src. It affects 2 products.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `openssl-src` | crates.io | All versions | 111.25.0 |
| `openssl-src` | crates.io | All versions | 111.25.0 |
| `openssl-src` | crates.io | From 0.0.0-0 | 111.25.0, 300.0.12 |
| `openssl-src` | crates.io | From 300.0.0 | 300.0.12 |
| `openssl-src` | crates.io | From 300.0.0 | 300.0.12 |

Products: Openssl Openssl, Stormshield Stormshield Network Security.

## How do I fix CVE-2022-4450?

Upgrade openssl-src to a fixed version for your release line: 111.25.0 or 300.0.12.

## Is CVE-2022-4450 being exploited?

There is no known exploitation of CVE-2022-4450 in the wild and no public exploit code.

## Other vulnerabilities in Openssl Openssl

- [CVE-2009-3245](https://insights.sbomify.com/CVE-2009-3245/): Null dereference in n/a (critical 10.0)
- [CVE-2006-3738](https://insights.sbomify.com/CVE-2006-3738/): Memory corruption in n/a (critical 10.0)
- [CVE-2026-63073](https://insights.sbomify.com/CVE-2026-63073/): Untrusted Sender DN Used as Format String in CMP Response Validation (critical 9.8)
- [CVE-2016-6309](https://insights.sbomify.com/CVE-2016-6309/): Use after free in n/a (critical 9.8)
- [CVE-2016-0799](https://insights.sbomify.com/CVE-2016-0799/): Integer overflow in n/a (critical 9.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2022-4450 and fix it if it is affected.

What it is: CVE-2022-4450 is a high-severity use after free vulnerability in Openssl Openssl, published on 8 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2022-4450 in the wild and no public exploit code.

Affected packages and fixed versions:
- openssl-src (crates.io): affected all versions; fixed in 111.25.0
- openssl-src (crates.io): affected all versions; fixed in 111.25.0
- openssl-src (crates.io): affected from 0.0.0-0; fixed in 111.25.0, 300.0.12
- openssl-src (crates.io): affected from 300.0.0; fixed in 300.0.12
- openssl-src (crates.io): affected from 300.0.0; fixed in 300.0.12

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2022-4450/ (Markdown: https://insights.sbomify.com/CVE-2022-4450/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2022-4450
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-4450
- OSV: https://osv.dev/vulnerability/CVE-2022-4450

---
From sbomify Insights: https://insights.sbomify.com/CVE-2022-4450/
Summaries are generated and may contain mistakes; the official description above is the record.