Critical severity · published Aug 22, 2022
CVE-2022-38667
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used
9.8
CVSS
3.1%
EPSS
No
On KEV
Description
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Crow · Crowcpp
through 1.0\+4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38667
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38667
Technical Description
https://cwe.mitre.org/data/definitions/372.html
Exploit
https://github.com/0xhebi/CVEs/blob/main/Crow/CVE-2022-38667.md
Patch
https://github.com/CrowCpp/Crow/pull/524
Exploit
https://gynvael.coldwind.pl/?id=753
More from Crow
9.8
CVE-2022-34970
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h
7.5
CVE-2026-116011
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
7.5
CVE-2022-38668
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller…
7.5
CVE-2021-23514
This affects the package Crow before 0.3+4
6.1
CVE-2023-26142
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values