Every CVE Search/ Get API key

CVE-2022-3715

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid...

7.8 HighFix available

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.38%Down 0.5 points since Jan 6, 2023
90%50%10%1%

What each source reports

NVD Score used 7.8

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Record
CVE-2022-3715
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
CVE List 7.8

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Record
CVE-2022-3715
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2022-43072 7.8

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Record
EUVD-2022-43072
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-cr4j-fv7c-759c 9.8

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid...

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Record
GHSA-cr4j-fv7c-759c
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
OSV 7.8

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Record
CVE-2022-3715
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-2100 5.5

bash security update

Bash is the GNU Project's shell. Bash is the Bourne Again SHell. Bash is an sh-compatible shell that incorporates useful features from the Korn shell (ksh) and C shell (csh). It is intended to conform to the IEEE POSIX P1003.2/ISO 9945.2 Shell and Tools standard. It offers functional improvements over sh for both programming and interactive use. In addition, most sh scripts can be run by Bash without modification.

Security Fix(es):

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid_parameter_transform. This issue may lead to memory problems.(CVE-2022-3715)

Record
OESA-2022-2100
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVRHSA-2023:0340 6.6

Red Hat Security Advisory: bash security update

Record
RHSA-2023:0340
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2023:0340 5.5

Moderate: bash security update

The bash packages provide Bash (Bourne-again shell), which is the default shell for Rocky Linux.

Security Fix(es):

  • bash: a heap-buffer-overflow in valid_parameter_transform (CVE-2022-3715)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:0340
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2022-3715 7.8

CVE-2022-3715 in bash - Patched by Root

Root has patched CVE-2022-3715 in the bash package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2022-3715
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-3715 7.8

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Record
UBUNTU-CVE-2022-3715
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:0340 No score

Moderate: bash security update

The bash packages provide Bash (Bourne-again shell), which is the default shell for AlmaLinux.

Security Fix(es):

  • bash: a heap-buffer-overflow in valid_parameter_transform (CVE-2022-3715)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:0340
Updated
2026-11-02
OSVDEBIAN-CVE-2022-3715 No score

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Record
DEBIAN-CVE-2022-3715
Updated
2026-11-03
OSVUSN-6697-1 No score

bash vulnerability

It was discovered that Bash incorrectly handled certain memory operations when processing commands. If a user or automated system were tricked into running a specially crafted bash file, a remote attacker could use this issue to cause Bash to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-6697-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bash
AlmaLinux:9
 before 5.1.8-6.el9_1
5.1.8-6.el9_1
bash-devel
AlmaLinux:9
 before 5.1.8-6.el9_1
5.1.8-6.el9_1
bash
Debian:12
 before 5.2-1
5.2-1
bash
Debian:13
 before 5.2-1
5.2-1
bash
Debian:14
 before 5.2-1
5.2-1
bash
openEuler:22.03-LTS
 before 5.1.8-6.oe2203
5.1.8-6.oe2203
bash
Red Hat:enterprise_linux:9::baseos
 before 0:5.1.8-6.el9_1
0:5.1.8-6.el9_1
bash-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:5.1.8-6.el9_1
0:5.1.8-6.el9_1
bash-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:5.1.8-6.el9_1
0:5.1.8-6.el9_1
bash-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:5.1.8-6.el9_1
0:5.1.8-6.el9_1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
bash-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:5.1.8-6.el9_1
0:5.1.8-6.el9_1
bash-devel
Red Hat:enterprise_linux:9::crb
 before 0:5.1.8-6.el9_1
0:5.1.8-6.el9_1
bash
Rocky Linux:9
 before 0:5.1.8-6.el9_1
0:5.1.8-6.el9_1
bash
Root:Debian:11
 before 5.1-2+deb11u1.root.io.1
5.1-2+deb11u1.root.io.15.1-2+deb11u1.root.io.35.1-2+deb11u1.root.io.45.1-2+deb11u1.root.io.85.1-2+deb11u1.root.io.25.1-2+deb11u1.root.io.55.1-2+deb11u1.root.io.65.1-2+deb11u1.root.io.75.1-2+deb11u1.root.io.95.1-2+deb11u1.aikido.10
rootio-bash
Root:Debian:11
 before 5.1-2+deb11u1.root.io.1
5.1-2+deb11u1.root.io.15.1-2+deb11u1.root.io.35.1-2+deb11u1.root.io.45.1-2+deb11u1.root.io.85.1-2+deb11u1.root.io.25.1-2+deb11u1.root.io.55.1-2+deb11u1.root.io.65.1-2+deb11u1.root.io.75.1-2+deb11u1.root.io.95.1-2+deb11u1.aikido.10
bash
Ubuntu:22.04:LTS
 before 5.1-6ubuntu1.1, plus listed versions
5.1-3ubuntu25.1-5ubuntu15.1-6ubuntu1
5.1-6ubuntu1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3715 is a high vulnerability (CVSS 7.8) in Gnu Bash, published November 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in bash 5.1.8-6.el9_1.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open