CVE-2022-44566

HIGH

ActiveRecord < 6.1.7.1 - Denial of Service via PostgreSQL Integer Comparison

Title source: llm

Description

A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.

References (2)

Core 2

Core References

Exploit, Mitigation, Third Party Advisory

https://code.jeremyevans.net/2022-11-01-forcing-sequential-scans-on-postgresql.html

Patch, Vendor Advisory

https://discuss.rubyonrails.org/t/cve-2022-44566-possible-denial-of-service-vulnerability-in-activerecords-postgresql-adapter/82119

Scores

CVSS v3 7.5

EPSS 0.0154

EPSS Percentile 81.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (2)

activerecord_project/activerecord < 6.1.7.1

rubygems/activerecord 0 - 6.1.7.1RubyGems

Published Feb 09, 2023

Tracked Since Feb 18, 2026