Every CVE Search/ Get API key

CVE-2022-4899

zstd vulnerable to buffer overrun

7.5 HighFix available

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.59%Up 1.5 points since Apr 1, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
CVE-2022-4899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
CVE List 7.5

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
CVE-2022-4899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-400
Updated
2026-11-02
EUVDEUVD-2023-0287 7.5

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
EUVD-2023-0287
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-5c9c-6x87-f9vm 7.5

zstd vulnerable to buffer overrun

A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun.

Record
GHSA-5c9c-6x87-f9vm
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVAZL-25813 7.5

CVE-2022-4899 affecting package zstd for versions less than 1.5.4-1

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
AZL-25813
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2022-4899 7.5

CVE-2022-4899 does not affect BellSoft software

Record
BELL-CVE-2022-4899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 19 moreShow less
OSV 7.5

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
CVE-2022-4899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-5c9c-6x87-f9vm 7.5

zstd vulnerable to buffer overrun

A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun.

Record
GHSA-5c9c-6x87-f9vm
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2023-1213 4.0

zstd security update

Zstd is a fast lossless compression algorithm. It's backed by a very fast entropy stage,provided by Huff0 and FSE library. It's a real-time compression scenario for zlib levels and has a better compression ratio.

Security Fix(es):

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.(CVE-2022-4899)

Record
OESA-2023-1213
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2023-1214 4.0

zstd security update

Zstd is a fast lossless compression algorithm. It's backed by a very fast entropy stage,provided by Huff0 and FSE library. It's a real-time compression scenario for zlib levels and has a better compression ratio.

Security Fix(es):

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.(CVE-2022-4899)

Record
OESA-2023-1214
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2024:0894 7.5

Red Hat Security Advisory: mysql:8.0 security update

Record
RHSA-2024:0894
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1141 7.5

Red Hat Security Advisory: mysql security update

Record
RHSA-2024:1141
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2619 7.5

Red Hat Security Advisory: rh-mysql80-mysql security update

Record
RHSA-2024:2619
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2024:0894 7.5

Moderate: mysql:8.0 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911)

  • mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933)

  • mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982)

  • mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962)

  • mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953, CVE-2023-21955)

  • mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966)

  • mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972)

  • mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980)

  • mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057)

  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008)

  • mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112)

  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033)

  • mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046, CVE-2023-22054, CVE-2023-22056)

  • mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053)

  • mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058)

  • mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114)

  • mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111)

  • mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115)

  • mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960)

  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963)

  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964)

  • mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967)

  • mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968)

  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969)

  • mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-20970, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982)

  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981)

  • mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983)

  • mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984)

  • mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985)

  • zstd: mysql: buffer overrun in util.c (CVE-2022-4899)

  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038)

  • mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048)

  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (Rocky Linux-22452)
Record
RLSA-2024:0894
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2022-4899 7.5

CVE-2022-4899 in libzstd - Patched by Root

Root has patched CVE-2022-4899 in the libzstd package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2022-4899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-4899 7.5

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
UBUNTU-CVE-2022-4899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2024:0894 No score

Moderate: mysql:8.0 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911)
  • mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982)
  • mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962)
  • mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953, CVE-2023-21955)
  • mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966)
  • mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972)
  • mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980)
  • mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046, CVE-2023-22054, CVE-2023-22056)
  • mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053)
  • mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058)
  • mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114)
  • mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111)
  • mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115)
  • mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960)
  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963)
  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964)
  • mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967)
  • mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968)
  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-20970, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982)
  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981)
  • mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983)
  • mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984)
  • mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985)
  • zstd: mysql: buffer overrun in util.c (CVE-2022-4899)
  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038)
  • mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048)
  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (AlmaLinux-22452)
Record
ALSA-2024:0894
Updated
2026-11-05
OSVALSA-2024:1141 No score

Moderate: mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911)
  • mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982)
  • mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962)
  • mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953)
  • mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21955)
  • mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966)
  • mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972)
  • mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980)
  • mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046)
  • mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053, CVE-2023-22054, CVE-2023-22056)
  • mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058)
  • mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114)
  • mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111)
  • mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115)
  • mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-2097, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982)
  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963)
  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964)
  • mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967)
  • mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968)
  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969)
  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981)
  • mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983)
  • mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984)
  • mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985)
  • zstd: mysql: buffer overrun in util.c (CVE-2022-4899)
  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038)
  • mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048)
  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113)

Bug Fix(es):

  • Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (AlmaLinux-22454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:1141
Updated
2026-11-02
OSVCLSA-2025-1739820848 No score

mysql: Fix of 129 CVEs

  • Update to MySQL 8.0.40
  • CVEs fixed: CVE-2024-21201 CVE-2024-21236 CVE-2024-21230 CVE-2024-21160 CVE-2024-21196 CVE-2024-21239 CVE-2024-21173 CVE-2024-21193 CVE-2024-21159 CVE-2024-21135 CVE-2024-20996 CVE-2024-21166 CVE-2024-21157 CVE-2024-21231 CVE-2024-21199 CVE-2024-21207 CVE-2024-21194 CVE-2024-21238 CVE-2024-21218 CVE-2024-21203 CVE-2024-21162 CVE-2024-21213 CVE-2024-21219 CVE-2024-21163 CVE-2024-21241 CVE-2024-21125 CVE-2024-21134 CVE-2024-21130 CVE-2024-21198 CVE-2024-21142 CVE-2024-21127 CVE-2024-21237 CVE-2024-21197 CVE-2024-21212 CVE-2024-21247 CVE-2024-21129 CVE-2024-21200 CVE-2024-21171 CVE-2024-21165 CVE-2024-21137 CVE-2024-21061 CVE-2024-21057 CVE-2024-21056 CVE-2024-21055 CVE-2024-21053 CVE-2024-21052 CVE-2024-21051 CVE-2024-21050 CVE-2024-21049 CVE-2024-20993 CVE-2024-20984 CVE-2024-20982 CVE-2024-20970 CVE-2024-20968 CVE-2024-20966 CVE-2024-20964 CVE-2024-20962 CVE-2024-20960 CVE-2024-21179 CVE-2024-21185 CVE-2024-21177 CVE-2024-20972 CVE-2024-20976 CVE-2024-20974 CVE-2024-20978 CVE-2024-20981 CVE-2024-20969 CVE-2024-20985 CVE-2024-20965 CVE-2024-20967 CVE-2024-20977 CVE-2024-20961 CVE-2024-20983 CVE-2024-20963 CVE-2024-20971 CVE-2024-20973 CVE-2023-22103 CVE-2023-22070 CVE-2023-22114 CVE-2023-22079 CVE-2023-22066 CVE-2023-22104 CVE-2023-22084 CVE-2023-22078 CVE-2023-22111 CVE-2023-22064 CVE-2023-22113 CVE-2023-22097 CVE-2023-22065 CVE-2023-22092 CVE-2023-22110 CVE-2023-22059 CVE-2023-22068 CVE-2023-22115 CVE-2023-22032 CVE-2023-22112 CVE-2023-22033 CVE-2023-22048 CVE-2023-21950 CVE-2023-22058 CVE-2023-22008 CVE-2023-22007 CVE-2023-22046 CVE-2023-22054 CVE-2023-22005 CVE-2023-22056 CVE-2023-22038 CVE-2023-22053 CVE-2023-22057 CVE-2023-21935 CVE-2023-21972 CVE-2023-21953 CVE-2023-21977 CVE-2023-21962 CVE-2023-21955 CVE-2023-21946 CVE-2023-21920 CVE-2023-21919 CVE-2023-21980 CVE-2023-21929 CVE-2023-21982 CVE-2023-21966 CVE-2023-21945 CVE-2023-21911 CVE-2023-21933 CVE-2023-21976 CVE-2023-21940 CVE-2023-21947 CVE-2022-4899
Record
CLSA-2025-1739820848
Updated
2026-11-02
OSVDEBIAN-CVE-2022-4899 No score

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
DEBIAN-CVE-2022-4899
Updated
2026-11-03
OSVMGASA-2023-0128 No score

Updated zstd packages fix security vulnerability

Buffer overrun in util.c (CVE-2022-4899)

Record
MGASA-2023-0128
Updated
2026-11-02
OSVopenSUSE-SU-2024:13613-1 No score

libzstd-devel-1.5.5-5.1 on GA media

These are all security issues fixed in the libzstd-devel-1.5.5-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13613-1
Updated
2026-11-02
OSVPYSEC-2023-121 No score

zstd vulnerable to buffer overrun

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Record
PYSEC-2023-121
Updated
2026-11-02
OSVSUSE-SU-2023:1688-1 No score

Security update for zstd

This update for zstd fixes the following issues:

  • CVE-2022-4899: Fixed buffer overrun in util.c (bsc#1209533).
Record
SUSE-SU-2023:1688-1
Updated
2026-11-02
OSVSUSE-SU-2023:2074-1 No score

Security update for zstd

This update for zstd fixes the following issues:

  • CVE-2022-4899: Fixed buffer overrun in util.c (bsc#1209533).
Record
SUSE-SU-2023:2074-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/facebook/zstd
SwiftURL
 before 1.5.4
1.5.4
zstd
PyPI
 before 1.5.4.0
1.5.4.0
mecab
AlmaLinux:8
From an advisory covering 87 CVEs
 before 0.996-2.module_el8.6.0+3340+d764b636
0.996-2.module_el8.6.0+3340+d764b636
mecab-devel
AlmaLinux:8
From an advisory covering 87 CVEs
 before 0.996-2.module_el8.6.0+3340+d764b636
0.996-2.module_el8.6.0+3340+d764b636
mecab-ipadic
AlmaLinux:8
From an advisory covering 87 CVEs
 before 2.7.0.20070801-16.module_el8.6.0+3340+d764b636
2.7.0.20070801-16.module_el8.6.0+3340+d764b636
mecab-ipadic-EUCJP
AlmaLinux:8
From an advisory covering 87 CVEs
 before 2.7.0.20070801-16.module_el8.6.0+3340+d764b636
2.7.0.20070801-16.module_el8.6.0+3340+d764b636
mysql
AlmaLinux:8
From an advisory covering 87 CVEs
 before 8.0.36-1.module_el8.9.0+3735+82bd6c11
8.0.36-1.module_el8.9.0+3735+82bd6c11
mysql-common
AlmaLinux:8
From an advisory covering 87 CVEs
 before 8.0.36-1.module_el8.9.0+3735+82bd6c11
8.0.36-1.module_el8.9.0+3735+82bd6c11
mysql-devel
AlmaLinux:8
From an advisory covering 87 CVEs
 before 8.0.36-1.module_el8.9.0+3735+82bd6c11
8.0.36-1.module_el8.9.0+3735+82bd6c11
mysql-errmsg
AlmaLinux:8
From an advisory covering 87 CVEs
 before 8.0.36-1.module_el8.9.0+3735+82bd6c11
8.0.36-1.module_el8.9.0+3735+82bd6c11
Show 91 moreShow less
Affected packages
PackageAffectedFixed
mysql-libs
AlmaLinux:8
From an advisory covering 87 CVEs
 before 8.0.36-1.module_el8.9.0+3735+82bd6c11
8.0.36-1.module_el8.9.0+3735+82bd6c11
mysql-server
AlmaLinux:8
From an advisory covering 87 CVEs
 before 8.0.36-1.module_el8.9.0+3735+82bd6c11
8.0.36-1.module_el8.9.0+3735+82bd6c11
mysql-test
AlmaLinux:8
From an advisory covering 87 CVEs
 before 8.0.36-1.module_el8.9.0+3735+82bd6c11
8.0.36-1.module_el8.9.0+3735+82bd6c11
mysql
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-common
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-devel
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-errmsg
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-libs
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-server
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-test
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
zstd
Azure Linux:2
 before 1.5.4-1
1.5.4-1
mysql
TuxCare:AlmaLinux:9.2
From an advisory covering 129 CVEs
 before 8.0.40-1.el9_2.tuxcare.els1
8.0.40-1.el9_2.tuxcare.els1
mysql-common
TuxCare:AlmaLinux:9.2
From an advisory covering 129 CVEs
 before 8.0.40-1.el9_2.tuxcare.els1
8.0.40-1.el9_2.tuxcare.els1
mysql-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 129 CVEs
 before 8.0.40-1.el9_2.tuxcare.els1
8.0.40-1.el9_2.tuxcare.els1
mysql-errmsg
TuxCare:AlmaLinux:9.2
From an advisory covering 129 CVEs
 before 8.0.40-1.el9_2.tuxcare.els1
8.0.40-1.el9_2.tuxcare.els1
mysql-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 129 CVEs
 before 8.0.40-1.el9_2.tuxcare.els1
8.0.40-1.el9_2.tuxcare.els1
mysql-server
TuxCare:AlmaLinux:9.2
From an advisory covering 129 CVEs
 before 8.0.40-1.el9_2.tuxcare.els1
8.0.40-1.el9_2.tuxcare.els1
mysql-test
TuxCare:AlmaLinux:9.2
From an advisory covering 129 CVEs
 before 8.0.40-1.el9_2.tuxcare.els1
8.0.40-1.el9_2.tuxcare.els1
libzstd
Debian:12
 before 1.5.4+dfsg2-1
1.5.4+dfsg2-1
libzstd
Debian:13
 before 1.5.4+dfsg2-1
1.5.4+dfsg2-1
libzstd
Debian:14
 before 1.5.4+dfsg2-1
1.5.4+dfsg2-1
zstd
PyPI
 before 1.5.4.0, plus listed versions
1.1.41.2.01.3.0.21.3.11.3.3
Show 31 moreShow less
1.3.41.3.4.31.3.4.41.3.4.51.3.5.01.3.5.11.3.8.01.3.8.11.4.0.01.4.1.01.4.3.21.4.4.01.4.5.01.4.5.11.4.8.01.4.8.11.4.9.01.4.9.11.5.0.01.5.0.11.5.0.21.5.0.31.5.0.41.5.1.01.5.2.01.5.2.11.5.2.21.5.2.31.5.2.41.5.2.51.5.2.6
1.5.4.0
zstd
Mageia:8
 before 1.4.8-1.2.mga8
1.4.8-1.2.mga8
zstd
openEuler:22.03-LTS-SP1
 before 1.5.0-4.oe2203sp1
1.5.0-4.oe2203sp1
zstd
openEuler:22.03-LTS
 before 1.5.0-4.oe2203
1.5.0-4.oe2203
mecab
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:0.996-2.module+el8.9.0+21207+6c20cb3d
0:0.996-2.module+el8.9.0+21207+6c20cb3d
mecab-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:0.996-2.module+el8.9.0+21207+6c20cb3d
0:0.996-2.module+el8.9.0+21207+6c20cb3d
mecab-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:0.996-2.module+el8.9.0+21207+6c20cb3d
0:0.996-2.module+el8.9.0+21207+6c20cb3d
mecab-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:0.996-2.module+el8.9.0+21207+6c20cb3d
0:0.996-2.module+el8.9.0+21207+6c20cb3d
mecab-ipadic
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:2.7.0.20070801-16.module+el8.9.0+21207+6c20cb3d
0:2.7.0.20070801-16.module+el8.9.0+21207+6c20cb3d
mecab-ipadic-EUCJP
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:2.7.0.20070801-16.module+el8.9.0+21207+6c20cb3d
0:2.7.0.20070801-16.module+el8.9.0+21207+6c20cb3d
mysql
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-common
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-devel-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-errmsg
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-server
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-server-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-test
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql-test-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
0:8.0.36-1.module+el8.9.0+21207+6c20cb3d
mysql
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-common
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-devel-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-errmsg
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-server
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-server-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-test-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-devel-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-libs
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-server-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-test
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
mysql-test-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 87 CVEs
 before 0:8.0.36-1.el9_3
0:8.0.36-1.el9_3
rh-mysql80-mysql
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-common
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-config
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-config-syspaths
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-errmsg
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-icu-data-files
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-server
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-server-syspaths
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-syspaths
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
rh-mysql80-mysql-test
Red Hat:rhel_software_collections:3::el7
From an advisory covering 86 CVEs
 before 0:8.0.36-1.el7
0:8.0.36-1.el7
mecab
Rocky Linux:8
From an advisory covering 87 CVEs
 before 0:0.996-2.module+el8.10.0+1676+9b4b6e24
0:0.996-2.module+el8.10.0+1676+9b4b6e24
mecab
Rocky Linux:8
From an advisory covering 87 CVEs
 before 0:0.996-2.module+el8.10.0+1937+28fbbc83
0:0.996-2.module+el8.10.0+1937+28fbbc83
mecab-ipadic
Rocky Linux:8
From an advisory covering 87 CVEs
 before 0:2.7.0.20070801-16.module+el8.10.0+1676+9b4b6e24
0:2.7.0.20070801-16.module+el8.10.0+1676+9b4b6e24
mysql
Rocky Linux:8
From an advisory covering 87 CVEs
 before 0:8.0.36-1.module+el8.10.0+1676+9b4b6e24
0:8.0.36-1.module+el8.10.0+1676+9b4b6e24
libzstd
Root:Debian:11
 before 1.4.8+dfsg-2.1.root.io.1
1.4.8+dfsg-2.1.root.io.11.4.8+dfsg-2.1.root.io.51.4.8+dfsg-2.1.root.io.21.4.8+dfsg-2.1.root.io.31.4.8+dfsg-2.1.root.io.41.4.8+dfsg-2.1.aikido.6
rootio-libzstd
Root:Debian:11
 before 1.4.8+dfsg-2.1.root.io.1
1.4.8+dfsg-2.1.root.io.11.4.8+dfsg-2.1.root.io.51.4.8+dfsg-2.1.root.io.21.4.8+dfsg-2.1.root.io.31.4.8+dfsg-2.1.root.io.41.4.8+dfsg-2.1.aikido.6
zstd
SUSE:Linux Enterprise Micro 5.3
 before 1.5.0-150400.3.3.1
1.5.0-150400.3.3.1
zstd
SUSE:Linux Enterprise Micro 5.4
 before 1.5.0-150400.3.3.1
1.5.0-150400.3.3.1
zstd
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 1.5.0-150400.3.3.1
1.5.0-150400.3.3.1
zstd
openSUSE:Leap Micro 5.3
 before 1.5.0-150400.3.3.1
1.5.0-150400.3.3.1
zstd
openSUSE:Leap 15.4
 before 1.5.0-150400.3.3.1
1.5.0-150400.3.3.1
zstd
SUSE:Linux Enterprise Real Time 15 SP3
 before 1.4.4-150000.1.9.1
1.4.4-150000.1.9.1
zstd
SUSE:Linux Enterprise Micro 5.1
 before 1.4.4-150000.1.9.1
1.4.4-150000.1.9.1
zstd
SUSE:Linux Enterprise Micro 5.2
 before 1.4.4-150000.1.9.1
1.4.4-150000.1.9.1
libzstd
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.8+dfsg-2.11.4.8+dfsg-2.1build11.4.8+dfsg-31.4.8+dfsg-3build1
 None known
zstd
openSUSE:Tumbleweed
 before 1.5.5-5.1
1.5.5-5.1

History

History
RecordedChangedSources
affected
facts, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4899 is a high vulnerability (CVSS 7.5) in Microsoft Zstd, published March 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in github.com/facebook/zstd 1.5.4.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 281 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open