CVE-2022-37454: Debian Linux

Critical severity, CVSS 9.8. EPSS: 5.8% chance of exploitation in the next 30 days.

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Extended Keccak Code Package Project Extended Keccak Code Package: affected versions not specified
• Fedoraproject Fedora: version 35 only; version 36 only
• PHP PHP: from 7.2.0, before 7.4.33 (fixed in 7.4.33); from 8.0.0, before 8.0.25 (fixed in 8.0.25); from 8.1.0, before 8.1.12 (fixed in 8.1.12)
• Pypy Pypy: from 7.0.0
• PYSHA3 Project PYSHA3: any version
• Python Python: from 3.6.0, before 3.7.16 (fixed in 3.7.16); from 3.8.0, before 3.8.16 (fixed in 3.8.16); from 3.9.0, before 3.9.16 (fixed in 3.9.16); from 3.10.0, before 3.10.9 (fixed in 3.10.9)
• SHA3 Project SHA3: before 1.0.5 (fixed in 1.0.5)

Published 2022-10-21. Last modified 2026-06-17.