Vulnerability record · CVE-2022-31698 · published 13 December 2022
CVE-2022-31698: vCenter Server content library denial of service via crafted header
Vmware · Cloud Foundation
VMware vCenter Server contains a denial-of-service flaw in the content library service. An unauthenticated attacker with network access to port 443 can send a specially crafted header to trigger the condition. Because vCenter is central management infrastructure, even a limited availability impact can disrupt virtualization operations.
Description
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Automated analysis
medium priorityThe flaw is remotely reachable without authentication but only causes limited availability impact, and no confirmed exploitation is documented despite high EPSS.
What it is
VMware vCenter Server contains a denial-of-service flaw in the content library service. An unauthenticated attacker with network access to port 443 can send a specially crafted header to trigger the condition. Because vCenter is central management infrastructure, even a limited availability impact can disrupt virtualization operations.
Impact
An attacker can cause a denial-of-service condition in the content library service, degrading or interrupting availability of that service. The CVSS vector shows availability impact is limited (A:L), with no confidentiality or integrity impact.
Attack surface
Reachable over the network on port 443 of vCenter Server; the CVSS vector indicates no privileges (PR:N) and no user interaction (UI:N) are required. The flaw is in the content library service, which is exposed through the vCenter web interface.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.478, ~98.8th percentile), suggesting elevated likelihood of exploitation activity, but the record provides no confirmed in-the-wild exploitation evidence.
What to do
- Apply the VMware fix per advisory VMSA-2022-0030; patch vCenter Server and Cloud Foundation to the corrected versions.
- Restrict network access to vCenter port 443 to trusted management networks and administrative hosts.
- Monitor and rate-limit requests to the content library service where feasible.
- Review vCenter exposure to untrusted networks and remove direct internet-facing access.
Detection
- Monitor vCenter content library service logs and vCenter availability for unexpected restarts or service failures.
- Alert on anomalous or malformed HTTP headers directed at vCenter port 443.
- Baseline normal request rates to the content library service and alert on spikes or repeated failures.
- Correlate vCenter service degradation events with source IPs for triage.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-31698 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-31698), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
