CVE-2022-44566

{"id": "CVE-2022-44566", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-44566", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-25T13:43:31.851211Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "n/a", "product": "https://github.com/rails/rails", "versions": [{"status": "affected", "version": "7.0.4.1, 6.1.7.1"}]}]}], "published": "2023-02-09T20:15:11.017", "references": [{"url": "https://code.jeremyevans.net/2022-11-01-forcing-sequential-scans-on-postgresql.html", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://discuss.rubyonrails.org/t/cve-2022-44566-possible-denial-of-service-vulnerability-in-activerecords-postgresql-adapter/82119", "tags": ["Patch", "Vendor Advisory"], "source": "support@hackerone.com"}, {"url": "https://code.jeremyevans.net/2022-11-01-forcing-sequential-scans-on-postgresql.html", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://discuss.rubyonrails.org/t/cve-2022-44566-possible-denial-of-service-vulnerability-in-activerecords-postgresql-adapter/82119", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio presente en el adaptador de PostgreSQL de ActiveRecord anterior a 7.0.4.1 y anterior a 6.1.7.1. Cuando se proporciona un valor fuera del rango de un entero con signo de 64 bits al adaptador de conexi\u00f3n de PostgreSQL, tratar\u00e1 el tipo de columna de destino como num\u00e9rico. Comparar valores enteros con valores num\u00e9ricos puede resultar en un escaneo secuencial lento, lo que puede llevar a una posible Denegaci\u00f3n de Servicio."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "959FB9CC-9272-4B41-A05B-4A65C2071899", "versionEndExcluding": "6.1.7.1"}, {"criteria": "cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "EDE689E3-57CB-4121-9EE3-1857079325E6", "versionEndExcluding": "7.0.4.1", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}