Loading vulnerability…
CVE-2022-3786 is a stack buffer overflow in OpenSSL 3.0.0 through 3.0.6 during X.509 name-constraint checking. Punycode decoding of an email address name constraint can be induced to overwrite an arbitrary number of stack bytes with the period character. The vulnerable path is reached after certificate-chain signature verification. The issue was introduced with OpenSSL 3.0.0; OpenSSL 1.0.2, 1.1.1, and earlier branches are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository provides a proof-of-concept (POC) fuzzing harness and environment for CVE-2022-3786, a buffer overrun vulnerability in OpenSSL's punycode handling (ossl_a2ulabel/ossl_punycode_decode). The structure includes a Dockerfile for setting up a reproducible environment, scripts for compiling OpenSSL at a vulnerable commit, and a C-based harness that feeds fuzzing inputs to the vulnerable function. The input directory contains various crafted test cases, and the run.sh script launches AFL++ to fuzz the harness. The confirm-vulnerability.c file provides a standalone test to check for the presence of the vulnerability. The repository is intended for security researchers to reproduce, fuzz, and confirm the vulnerability in a controlled local environment. No remote or network endpoints are present; the attack vector is local, targeting the OpenSSL library via direct input to the vulnerable function.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A buffer overflow vulnerability in OpenSSL punycode decoding functions.
A HIGH severity X.509 email address variable length buffer overflow in OpenSSL 3.0.x related to punycode decoding for email address name constraints in X.509 certificates. Remote code execution is not expected on any platforms.
Unknown
An OpenSSL vulnerability described as an X.509 certificate verification buffer overrun; Microsoft shipped patches/updates for affected Microsoft products bundling OpenSSL.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.