CVE-2022-41404

org.ini4j allows attackers to cause a Denial of Service (DoS)

7.5 HighPublic exploitFix available

An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.83%Up 0.9 points since Oct 12, 2022

What each source reports

NVD Score used 7.5

An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: CVE-2022-41404
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

CVE List 7.5

An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: CVE-2022-41404
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2022-7120 7.5

An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: EUVD-2022-7120
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jr6h-r7vg-f9mc 7.5

org.ini4j allows attackers to cause a Denial of Service (DoS)

An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: GHSA-jr6h-r7vg-f9mc
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 7.5

An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: CVE-2022-41404
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-jr6h-r7vg-f9mc 7.5

org.ini4j allows attackers to cause a Denial of Service (DoS)

An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: GHSA-jr6h-r7vg-f9mc
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-41404 7.5

An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: UBUNTU-CVE-2022-41404
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-41404 No score

An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Record: DEBIAN-CVE-2022-41404
Updated: 2026-11-03

OSVopenSUSE-SU-2024:13788-1 No score

ini4j-0.5.4-1.1 on GA media

These are all security issues fixed in the ini4j-0.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13788-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.ini4j:ini4j` Maven	through 0.5.4	None known
`ini4j` Debian:12	before 0.5.4-1	0.5.4-1
`ini4j` Debian:13	before 0.5.4-1	0.5.4-1
`ini4j` Debian:14	before 0.5.4-1	0.5.4-1
`ini4j` Debian:10	before 0.5.4-1~deb10u1, plus listed versions 0.5.2-SNAPSHOT-50.5.2-SNAPSHOT-5.1	0.5.4-1~deb10u1
`org.ini4j:ini4j` Maven	through 0.5.4, plus listed versions 0.3.10.3.20.3.30.4.00.4.1 Show 4 moreShow less 0.4.1.bad0.5.00.5.10.5.2	None known
`ini4j` Ubuntu:18.04:LTS	All versions, plus listed versions 0.5.2-SNAPSHOT-5	None known
`ini4j` Ubuntu:20.04:LTS	All versions, plus listed versions 0.5.2-SNAPSHOT-5	None known
`ini4j` openSUSE:Tumbleweed	before 0.5.4-1.1	0.5.4-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	fdjy1234/CVE-2022-41404-DoS-Protection	2026-09-15

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-41404 is a high vulnerability (CVSS 7.5) in Ini4j Project Ini4j, published October 11, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 79th percentile. Fixed in ini4j 0.5.4-1.

References

Show 4 moreShow less