Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m78y-81wr-y3cz
Vulnerability ID VCID-m78y-81wr-y3cz
Aliases CVE-2022-25881
GHSA-rc47-6667-2j5j
Summary http-cache-semantics vulnerable to Regular Expression Denial of Service http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25881.json
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
epss 0.00221 https://api.first.org/data/v1/epss?cve=CVE-2022-25881
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rc47-6667-2j5j
cvssv3.1 7.5 https://github.com/kornelski/http-cache-semantics
generic_textual HIGH https://github.com/kornelski/http-cache-semantics
cvssv3.1 5.3 https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
cvssv3.1 7.5 https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
generic_textual HIGH https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
ssvc Track* https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
cvssv3.1 7.5 https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74
generic_textual HIGH https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-25881
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-25881
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20230622-0008
generic_textual HIGH https://security.netapp.com/advisory/ntap-20230622-0008
cvssv3.1 5.3 https://security.netapp.com/advisory/ntap-20230622-0008/
ssvc Track* https://security.netapp.com/advisory/ntap-20230622-0008/
cvssv3.1 5.3 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
cvssv3.1 7.5 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
ssvc Track* https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
cvssv3.1 5.3 https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
cvssv3.1 7.5 https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
ssvc Track* https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25881.json
https://api.first.org/data/v1/epss?cve=CVE-2022-25881
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/kornelski/http-cache-semantics
https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74
https://security.netapp.com/advisory/ntap-20230622-0008
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
2165824 https://bugzilla.redhat.com/show_bug.cgi?id=2165824
CVE-2022-25881 https://nvd.nist.gov/vuln/detail/CVE-2022-25881
GHSA-rc47-6667-2j5j https://github.com/advisories/GHSA-rc47-6667-2j5j
ntap-20230622-0008 https://security.netapp.com/advisory/ntap-20230622-0008/
RHSA-2023:1428 https://access.redhat.com/errata/RHSA-2023:1428
RHSA-2023:1533 https://access.redhat.com/errata/RHSA-2023:1533
RHSA-2023:1582 https://access.redhat.com/errata/RHSA-2023:1582
RHSA-2023:1583 https://access.redhat.com/errata/RHSA-2023:1583
RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
RHSA-2023:1743 https://access.redhat.com/errata/RHSA-2023:1743
RHSA-2023:1744 https://access.redhat.com/errata/RHSA-2023:1744
RHSA-2023:2654 https://access.redhat.com/errata/RHSA-2023:2654
RHSA-2023:2655 https://access.redhat.com/errata/RHSA-2023:2655
RHSA-2023:3815 https://access.redhat.com/errata/RHSA-2023:3815
RHSA-2023:5533 https://access.redhat.com/errata/RHSA-2023:5533
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25881.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kornelski/http-cache-semantics
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-27T17:16:22Z/ Found at https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-25881
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20230622-0008
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://security.netapp.com/advisory/ntap-20230622-0008/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-27T17:16:22Z/ Found at https://security.netapp.com/advisory/ntap-20230622-0008/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-27T17:16:22Z/ Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-27T17:16:22Z/ Found at https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
Exploit Prediction Scoring System (EPSS)
Percentile 0.41562
EPSS Score 0.00196
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:50:50.239712+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.webjars.npm/http-cache-semantics/CVE-2022-25881.yml 38.0.0