CVE-2022-25892: Muhammara Project Muhammara

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

Affected products

• Muhammara Project Muhammara: any version; before 2.6.1 (fixed in 2.6.1); version 3.0.0 only; version 3.1.0 only

Published 2022-11-01. Last modified 2026-06-17.