Loading vulnerability…
CVE-2022-3786 is a stack-based buffer overrun in OpenSSL 3.0.0 through 3.0.6 during X.509 certificate verification, specifically in name constraint checking associated with punycode decoding of email address constraints. The vulnerable code was introduced in OpenSSL 3.0.0. An attacker can craft a malicious email address in a certificate such that verification overflows an arbitrary number of stack bytes with the '.' character (decimal 46). The flaw is reached after certificate chain signature verification and generally requires either a malicious certificate signed by a CA trusted by the target or an application that continues certificate verification despite failure to build a path to a trusted issuer. In TLS client scenarios, the issue can be triggered by connecting to a malicious server presenting the crafted certificate. In TLS server scenarios, it can be triggered when client certificate authentication is enabled and a malicious client presents the crafted certificate.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository provides a proof-of-concept (POC) fuzzing harness and environment for CVE-2022-3786, a buffer overrun vulnerability in OpenSSL's punycode handling (ossl_a2ulabel/ossl_punycode_decode). The structure includes a Dockerfile for setting up a reproducible environment, scripts for compiling OpenSSL at a vulnerable commit, and a C-based harness that feeds fuzzing inputs to the vulnerable function. The input directory contains various crafted test cases, and the run.sh script launches AFL++ to fuzz the harness. The confirm-vulnerability.c file provides a standalone test to check for the presence of the vulnerability. The repository is intended for security researchers to reproduce, fuzz, and confirm the vulnerability in a controlled local environment. No remote or network endpoints are present; the attack vector is local, targeting the OpenSSL library via direct input to the vulnerable function.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A buffer overflow vulnerability in OpenSSL punycode decoding functions.
A HIGH severity X.509 email address variable length buffer overflow in OpenSSL 3.0.x related to punycode decoding for email address name constraints in X.509 certificates. Remote code execution is not expected on any platforms.
Unknown
An OpenSSL vulnerability described as an X.509 certificate verification buffer overrun; Microsoft shipped patches/updates for affected Microsoft products bundling OpenSSL.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.