Vulnerability record · CVE-2022-2526 · published 9 September 2022

CVE-2022-2526: Systemd project systemd use after free vulnerability

Systemd Project · Systemd

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

9.8 CVSS 3.1 Critical EPSS 1.3% · top 30.0% CWE-416 · Use after free

9.8CVSS 3.1 base score

1.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

6Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

NActive Iq Unified Manager Netapp NH300s Firmware Netapp NH410s Firmware Netapp NH500s Firmware Netapp NH700s Firmware Netapp

Systemd Systemd Project

References

Link	Tags
https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c	PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20221111-0005/	Third Party Advisory
https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c	PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20221111-0005/	Third Party Advisory

Track CVE-2022-2526 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-54085AMI MegaRAC SPx BMC authentication bypass via Redfish Host InterfaceAMI's SPx BMC implementation contains an authentication bypass reachable remotely through the Redfish Host Interface, classified as CWE-290 (authenti…KEVEPSS 61%analysed11 Mar 2025 10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed10 Dec 2021 8.8CVE-2023-41993Apple WebKit improper check allows arbitrary code executionCVE-2023-41993 is a WebKit flaw where processing web content can lead to arbitrary code execution, addressed with improved checks. Apple states it is…KEVEPSS 24%analysed21 Sep 2023 8.8CVE-2023-4863libwebp Heap Buffer Overflow via Crafted WebP ImageA heap buffer overflow in libwebp allows an out-of-bounds memory write when processing a crafted WebP image. It affects Google Chrome before 116.0.58…KEVEPSS 100%analysed12 Sep 2023 8.4CVE-2022-0185Linux Kernel Filesystem Context Heap Buffer OverflowThe legacy_parse_param function in the Linux kernel's Filesystem Context functionality fails to properly verify supplied parameter lengths, causing a…KEVEPSS 25%analysed11 Feb 2022 8.1CVE-2018-11776Apache Struts namespace handling flaw enables remote code executionApache Struts 2.3 through 2.3.34 and 2.5 through 2.5.16 can execute remote code when alwaysSelectFullNamespace is enabled and results or url tags are…KEVEPSS 100%analysed22 Aug 2018 8.1CVE-2017-12617Apache Tomcat Default Servlet JSP upload leads to remote code executionApache Tomcat with HTTP PUT enabled (for example, the Default servlet readonly parameter set to false) allows an attacker to upload a JSP file throug…KEVEPSS 100%analysed4 Oct 2017 7.8CVE-2024-1086Linux kernel nf_tables use-after-free allows local privilege escalationThe Linux kernel's netfilter nf_tables component has a use-after-free in nft_verdict_init(), where positive drop errors are accepted and nf_hook_slow…KEVEPSS 28%analysed31 Jan 2024

Source: NIST National Vulnerability Database (record CVE-2022-2526), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.