CVE-2022-37454
criticalThe Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary…
Vendor / product: Extended Keccak Code Package Project — extended keccak code package
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2022-10-21 06:15
Modified: 2026-10-14 18:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
extended_keccak_code_package_project / extended_keccak_code_package all versions
debian / debian_linux 10.0, 11.0
fedoraproject / fedora 35, 36
php / php ≥7.2.0 <7.4.33, ≥8.0.0 <8.0.25, ≥8.1.0 <8.1.12
python / python ≥3.6.0 <3.7.16, ≥3.8.0 <3.8.16, ≥3.9.0 <3.9.16, ≥3.10.0 <3.10.9
sha3_project / sha3 <1.0.5
pysha3_project / pysha3 all versions
pypy / pypy ≥7.0.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
Patch / mitigation: https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
References
- https://csrc.nist.gov/projects/hash-functions/sha-3-project cve@mitre.org
- https://eprint.iacr.org/2023/331 cve@mitre.org
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://mouha.be/sha-3-buffer-overflow/ cve@mitre.org
- https://news.ycombinator.com/item?id=33281106 cve@mitre.org
- https://news.ycombinator.com/item?id=35050307 cve@mitre.org
- https://security.gentoo.org/glsa/202305-02 cve@mitre.org
- https://www.debian.org/security/2022/dsa-5267 cve@mitre.org
- https://www.debian.org/security/2022/dsa-5269 cve@mitre.org
- https://csrc.nist.gov/projects/hash-functions/sha-3-project af854a3a-2127-422b-91ae-364da2661108
- https://eprint.iacr.org/2023/331 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://mouha.be/sha-3-buffer-overflow/ af854a3a-2127-422b-91ae-364da2661108
- https://news.ycombinator.com/item?id=33281106 af854a3a-2127-422b-91ae-364da2661108
- https://news.ycombinator.com/item?id=35050307 af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/202305-02 af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20230203-0001/ af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗