{"id":"CVE-2022-31626","published":"2022-06-16T05:45:16Z","modified":"2024-09-17T03:38:54Z","title":"mysqlnd/pdo password buffer overflow","vendor":"PHP Group","product":"PHP","tier":"core","eol":null,"affectedVersions":[{"vendor":"PHP Group","product":"PHP","versions":[">= 7.4.X, < 7.4.30",">= 8.0.X, < 8.0.20",">= 8.1.X, < 8.1.7"]}],"description":{"text":"In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.","provenance":"source","from":"CVE.org"},"summary":{"text":"A buffer overflow in the mysqlnd driver of PHP's pdo_mysql extension, affecting PHP 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, occurs when the password supplied for a connection is excessively long. An attacker who can supply the host to connect to and the connection password, with low privileges, can trigger the overflow, potentially leading to remote code execution under the conditions that the third party is permitted to set those connection parameters.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:18Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.58123,"percentile":0.99089,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"https://bugs.php.net/bug.php?id=81719","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/","tags":["vendor-advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5179","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220722-0005/","tags":[]},{"url":"https://security.gentoo.org/glsa/202209-20","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html","tags":["mailing-list"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-53078","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53078","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2022-12-06","earliestUrl":"https://github.com/amitlttwo/CVE-2022-31626","repos":[{"name":"amitlttwo/CVE-2022-31626","url":"https://github.com/amitlttwo/CVE-2022-31626","stars":6,"created":"2022-12-06"},{"name":"HORKimhab/CVE-2022-31626-CVE-2024-2961-CVE-2019-6977","url":"https://github.com/HORKimhab/CVE-2022-31626-CVE-2024-2961-CVE-2019-6977","stars":0,"created":"2026-08-06"}]},"first":{"date":"2022-12-06","source":"PoC-in-GitHub","url":"https://github.com/amitlttwo/CVE-2022-31626"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-06-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-31626","provenance":"source"},{"date":"2022-12-06","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/amitlttwo/CVE-2022-31626","provenance":"source"}],"speed":{"daysToPublicExploit":173,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9909"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}