CVE-2022-25852

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Incorrect Type Conversion or Cast pada libpq project libpq, pg-native project pg-native. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.

Rincian

Terbit di NVD

17 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://snyk.io/vuln/SNYK-JS-LIBPQ-2392366 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-PGNATIVE-2392365 exploit · advisory pihak ketiga