Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-knss-jhn4-8ufw
Vulnerability ID VCID-knss-jhn4-8ufw
Aliases CVE-2022-29167
GHSA-44pw-h2cw-w3vq
Summary Regular Expression Denial of Service Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29167.json
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2022-29167
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2022-29167
cvssv3.1 7.4 https://github.com/mozilla/hawk
generic_textual HIGH https://github.com/mozilla/hawk
cvssv3.1 7.4 https://github.com/mozilla/hawk/commit/d10d72ca82db967f6c5fcf866ff78e3ca25ce1ab
generic_textual HIGH https://github.com/mozilla/hawk/commit/d10d72ca82db967f6c5fcf866ff78e3ca25ce1ab
cvssv3.1 7.4 https://github.com/mozilla/hawk/pull/286
generic_textual HIGH https://github.com/mozilla/hawk/pull/286
ssvc Track https://github.com/mozilla/hawk/pull/286
cvssv3.1 7.4 https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
generic_textual HIGH https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
ssvc Track https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
cvssv3.1 7.4 https://nvd.nist.gov/vuln/detail/CVE-2022-29167
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-29167
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29167.json
https://api.first.org/data/v1/epss?cve=CVE-2022-29167
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29167
https://github.com/mozilla/hawk
https://github.com/mozilla/hawk/commit/d10d72ca82db967f6c5fcf866ff78e3ca25ce1ab
https://github.com/mozilla/hawk/pull/286
https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
2082387 https://bugzilla.redhat.com/show_bug.cgi?id=2082387
CVE-2022-29167 https://nvd.nist.gov/vuln/detail/CVE-2022-29167
GHSA-44pw-h2cw-w3vq https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
USN-6116-1 https://usn.ubuntu.com/6116-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29167.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H Found at https://github.com/mozilla/hawk
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H Found at https://github.com/mozilla/hawk/commit/d10d72ca82db967f6c5fcf866ff78e3ca25ce1ab
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H Found at https://github.com/mozilla/hawk/pull/286
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:07:46Z/ Found at https://github.com/mozilla/hawk/pull/286
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H Found at https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:07:46Z/ Found at https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-29167
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.37936
EPSS Score 0.0017
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:42:27.519417+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/hawk/CVE-2022-29167.yml 38.6.0