Vulnpedia
← All CVEs

CVE-2022-4904

HIGH 8.6 ALL-YEARS

Published 2023-03-06 · Last modified 2025-12-02 · redhat · NVD: Modified

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

ELEVATED IMPACT

Severe if exploited (CVSS 8.6), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

1.2%chance of exploitation in 30 days · 69th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

8.6CVSS 3.1 · HIGH · ADP

  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors C Ares Project Redhat Fedoraproject

Products C Ares Software Collections Enterprise Linux Fedora

Weakness (CWE)

  • CWE-20: ->CWE-119
  • CWE-1284: Improper Validation of Specified Quantity in Input

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 430 vendor product statements; 398 omitted. Read the full vendor advisory.

  • rh-nodejs14-0:3.6-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • rh-nodejs14-npm-0:6.14.18-14.21.3.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • rh-nodejs14-npm-0:6.14.18-14.21.3.2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-devel-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.4.0%2B18317%2B43f5ac16?arch=s390x&epoch=1&rpmmod=nodejs:14:8040020230306170312:522a0ee4

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x&epoch=1&rpmmod=nodejs:14:8060020230306170237:ad008a3a

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x&epoch=1&rpmmod=nodejs:14:8060020230306170237:ad008a3a

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.src (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.7.0%2B18373%2B704f5cef?arch=src&epoch=1&rpmmod=nodejs:16:8070020230314140722:bd1311ed

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-debugsource-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64&epoch=1&rpmmod=nodejs:16:8070020230314140722:bd1311ed

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-full-i18n-1:16.19.1-1.module+el8.7.0+18373+704f5cef.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.7.0%2B18373%2B704f5cef?arch=x86_64&epoch=1&rpmmod=nodejs:16:8070020230314140722:bd1311ed

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.8.0%2B19021%2B4b8b11cc?arch=aarch64&epoch=1&rpmmod=nodejs:18:8080020230607122508:63b34585

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-full-i18n-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.8.0%2B19021%2B4b8b11cc?arch=aarch64&epoch=1&rpmmod=nodejs:18:8080020230607122508:63b34585

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-debuginfo-0:1.17.1-5.el9_0.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0.2?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-debuginfo-1:16.20.2-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=ppc64le&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-libs-debuginfo-1:16.20.2-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=aarch64&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-debugsource-0:1.17.1-5.el9_2.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.2?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-debuginfo-1:16.19.1-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=i686&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-devel-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel9.2.0.z%2B18497%2Ba402347c?arch=aarch64&epoch=1&rpmmod=nodejs:18:9020020230327152102:rhel9

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-libs-1:16.19.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=x86_64&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • npm-1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel9.2.0.z%2B18497%2Ba402347c?arch=s390x&epoch=1&rpmmod=nodejs:18:9020020230327152102:rhel9

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-0:1.13.0-6.el8_8.3.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.3?arch=i686

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-devel-0:1.13.0-6.el8_8.3.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.3?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-debugsource-0:1.13.0-8.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-debugsource-0:1.17.1-5.el9_0.2.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0.2?arch=i686

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-debugsource-0:1.17.1-5.el9_2.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.2?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-debugsource-0:1.19.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-devel as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/c-ares-devel

    • no fix planned: Out of support scope
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares.src as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/c-ares?arch=src

    • no fix planned: Out of support scope
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/c-ares

    • no fix planned: Will not fix
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/c-ares-devel

    • no fix planned: Will not fix
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • c-ares.src as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/c-ares?arch=src

    • no fix planned: Will not fix
    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-nodemon-0:2.0.20-3.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_2?arch=noarch

    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00
  • nodejs-nodemon-0:2.0.20-3.el9_2.src as a component of Red Hat Enterprise Linux AppStream (v. 9) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_2?arch=src

    Red Hat · CVE-2022-4904 · Updated 2026-06-28T06:28:42+00:00

Known Affected Software Configurations

VendorProductVersion range
C Ares ProjectC Ares< 1.19.0
RedhatSoftware Collections*
RedhatEnterprise Linux8.0
RedhatEnterprise Linux9.0
FedoraprojectFedora36

All CVSS metrics

  • HIGH 8.6 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  • HIGH 8.6 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS