ZeroDay Findings
Sign inSign up

Findings

CVE-2022-1473

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries.

Published May 3, 2022 · updated Oct 14, 2026 · openssl openssl

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Timeline

Detection, updates, and resolution for this record.

  1. May 3, 2022 · NIST NVD

    Detected

    The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of

  2. Oct 14, 2026 · NIST NVD

    Updated

    The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of

Affected

  • cpe netapp/a700s firmwareversion unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/clustered data ontap antivirus connectorversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe netapp/santricity smi-s providerversion unspecified
  • cpe netapp/smi-s providerversion unspecified
  • cpe netapp/snapmanagerversion unspecified
  • cpe netapp/solidfire, enterprise sds & hci storage nodeversion unspecified
  • cpe openssl/opensslversion unspecified

Sources

  • CVE.orgCVE-2022-1473

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2022-1473

    The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its

    nvd.nist.gov

References