Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-86j1-j381-cucy
Vulnerability ID VCID-86j1-j381-cucy
Aliases CVE-2022-2509
GNUTLS-SA-2022-07-07
Summary Multiple vulnerabilities have been discovered in GnuTLS, the worst of which could lead to a denial of service.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2509.json
cvssv3.1 7.5 https://access.redhat.com/security/cve/CVE-2022-2509
ssvc Track https://access.redhat.com/security/cve/CVE-2022-2509
epss 0.00628 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00628 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00628 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00908 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00908 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00908 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00908 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00908 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
epss 0.00908 https://api.first.org/data/v1/epss?cve=CVE-2022-2509
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html
ssvc Track https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
cvssv3.1 7.5 https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html
ssvc Track https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html
cvssv3.1 7.5 https://www.debian.org/security/2022/dsa-5203
ssvc Track https://www.debian.org/security/2022/dsa-5203
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2509.json
https://api.first.org/data/v1/epss?cve=CVE-2022-2509
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2509
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
004746.html https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html
2108977 https://bugzilla.redhat.com/show_bug.cgi?id=2108977
6FL27JS3VM74YEQU7PGB62USO3KSBYZX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
CVE-2022-2509 https://access.redhat.com/security/cve/CVE-2022-2509
dsa-5203 https://www.debian.org/security/2022/dsa-5203
GLSA-202411-06 https://security.gentoo.org/glsa/202411-06
msg00002.html https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html
RHSA-2022:6854 https://access.redhat.com/errata/RHSA-2022:6854
RHSA-2022:7105 https://access.redhat.com/errata/RHSA-2022:7105
USN-5550-1 https://usn.ubuntu.com/5550-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2509.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/security/cve/CVE-2022-2509
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:43:57Z/ Found at https://access.redhat.com/security/cve/CVE-2022-2509
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:43:57Z/ Found at https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:43:57Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:43:57Z/ Found at https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.debian.org/security/2022/dsa-5203
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:43:57Z/ Found at https://www.debian.org/security/2022/dsa-5203
Exploit Prediction Scoring System (EPSS)
Percentile 0.70257
EPSS Score 0.00628
Published At April 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:03:04.348933+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202411-06 38.0.0