CVE-2024-22086

CRITICAL 9.8EPSS 1.1%

handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code execution.

CVSS v3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.10% chance of exploitation in the next 30 days, 63th percentile
Published: 2024-01-05
Updated: 2025-06-18

Proof-of-concept exploits (1)

hayyp/cherry/issues/1

References

Related