CVE-2022-38778: Decode-Uri-Component Project Decode-Uri-Component

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

Affected products

• Decode-Uri-Component Project Decode-Uri-Component: before 0.2.1 (fixed in 0.2.1)
• Elastic Kibana: from 7.0.0, before 7.17.9 (fixed in 7.17.9); from 8.0.0, before 8.6.1 (fixed in 8.6.1)

Published 2023-02-08. Last modified 2026-06-17.