PT-2022-12968 · Xnio+1 · Xnio+1

Orangedog · Published 2022-08-26 · Updated 2026-01-09 · CVE-2022-0084

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions XNIO versions prior to 3.x

Description A flaw was found in XNIO, specifically in the notifyReadClosed method, which was logging a message to another expected end. This issue allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.

Recommendations For versions prior to 3.x, update to the 3.x branch of the repository to resolve the issue. As a temporary workaround, consider disabling the notifyReadClosed method until a patch is available. Restrict access to the affected logging functionality to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-0084

GHSA-76FG-MHRG-FMMG

OESA-2026-1047

RHSA-2022:4918

RHSA-2022:4919

RHSA-2022:6782

RHSA-2022:6783

RHSA-2022:7409

RHSA-2022:7410

RHSA-2022:7411

RHSA-2025:4226

RHSA-2025:4437

Affected Products

Debian

Xnio

References · 16

• https://github.com/xnio/xnio/commit/fdefb3b8b715d33387cadc4d48991fb1989b0c12 · Patch
• https://github.com/xnio/xnio/pull/291 · Patch
• https://cve.org/CVERecord?id=CVE-2022-0084 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0084 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2064226 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0084 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-76fg-mhrg-fmmg · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0084 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2022-0084 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0084 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0084 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1047 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0084 · Vendor Advisory
• https://github.com/xnio/xnio · Note
• https://t.me/cibsecurity/48920 · Telegram Post