PT-2022-7465 · Haskell+2 · Aeson+2

Published 2022-10-10 · Updated 2025-11-14 · CVE-2022-3433

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions aeson (affected versions not specified)

Description The aeson library is not safe for consuming untrusted JSON input. A remote user could exploit this issue to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service. This technique has been used in real-world attacks against various languages, libraries, and frameworks. The issue results in CPU consumption, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-916

CWE-328

Related Identifiers

BDU:2024-06542

BDU:2024-06544

CVE-2022-3433

HSEC-2023-0001

Affected Products

Debian

Red Os

Aeson

References · 37

• 🔥 https://cs-syd.eu/posts/2021-09-11-json-vulnerability · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3433 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3433 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06542 · Security Note
• https://bdu.fstec.ru/vul/2024-06544 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3433 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3433 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3433 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WT3JL7JQDIAFKKEFARWYES7GZNWGQNCI · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3433 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-1127SE17MD · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2024-0905SE18MD · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3433 · Vendor Advisory