{"id":"CVE-2022-3222","summary":"Uncontrolled Recursion in gpac/gpac","details":"Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV.","modified":"2026-08-18T14:46:38.925488Z","published":"2022-09-15T00:00:00Z","database_specific":{"cna_assigner":"@huntrdev","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3222.json","unresolved_ranges":[{"extracted_events":[{"fixed":"2.1.0-DEV"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/b29c69fa-3eac-41e4-9d4f-d861aba18235"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3222.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3222"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5411"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"4e7736d7ec7bf64026daa611da951993bb42fdaf"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-3222.json","vanir_signatures_modified":"2026-08-18T14:46:38Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"152548751986668109417274184410288546179","length":1547},"id":"CVE-2022-3222-42e89bc0","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"file":"src/bifs/script_dec.c","function":"SFScript_Parse"}},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"function":"SFS_ObjectMethodCall","file":"src/bifs/script_dec.c"},"deprecated":false,"digest":{"function_hash":"331879714757837856953181822884820835302","length":224},"id":"CVE-2022-3222-474a309c","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"file":"src/bifs/script_dec.c","function":"SFS_Expression"},"deprecated":false,"digest":{"function_hash":"69847878512898825380940233816501172956","length":4667},"id":"CVE-2022-3222-48ab3e29"},{"id":"CVE-2022-3222-605efaec","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"file":"src/bifs/script_dec.c","function":"SFS_ObjectMemberAccess"},"deprecated":false,"digest":{"function_hash":"226600477919031763394356863510355331846","length":149}},{"deprecated":false,"digest":{"function_hash":"172275504548231314228031913240702159344","length":243},"id":"CVE-2022-3222-9e365ca3","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"file":"src/bifs/script_dec.c","function":"SFS_Params"}},{"deprecated":false,"digest":{"length":196,"function_hash":"279842356874121167819696679175520043901"},"id":"CVE-2022-3222-abe9c9df","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"file":"src/bifs/script_dec.c","function":"SFS_CompoundExpression"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"file":"src/bifs/script_dec.c"},"deprecated":false,"digest":{"line_hashes":["93769238099744293990574198912715688549","16684320883667779780013971939577848413","13072298173710837429753773568200234950","50541879380774993142739672171007633839","33276104114025004623049815024874060701","210853583799579189836368780277023469634","94631336103126635382413622747963789809","280984418119766336169488039905784538533","103170967453593120147266420566062394763","293438568397011078936074100343821016047","177985014262781139194749937369864210712","250576156544465753775039380778721018047","219372667083227401145305139722420048515","303812540082546093051596886458612772285","338603819803443728571811893303991060059","318832085323913735814264349366140489504","16994598366761745429161361977994238123","270078249550604817451002257052125643101","245472757462949721730415315070339662860","185785765132220708008654907469555567461","65721388308671627220147168382151911187","222618054502721725638777197626642343275","316561285708328677909305912452842599582","166270306270758212974837385069958252554","144459850437870475529715690875449241079","329950310141117932784977613599213419623","304448795037209233002277664030773741166","166603041506421331226812376042031418434","104903844227082796855862770858179051891","164288467698074160239761814844762931421","200481239083631202804246393130355294190","190893820073328000004020441037534841936","51797522576982673565082333415238392995","10583261046340493989089200654944509342","131747881299407650165638068874929380031","190893820073328000004020441037534841936","51797522576982673565082333415238392995","164387929061375942872070763895637349699","186588166416445651530534420185204589313","96703598782202191156498606356145342744","304234878585700073097275978320276652150","169487420722736817377997064744674500788"],"threshold":0.9},"id":"CVE-2022-3222-b6b19dff"},{"source":"https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf","target":{"file":"src/bifs/script_dec.c","function":"SFS_ArrayDeref"},"deprecated":false,"digest":{"function_hash":"117029064440793121557232748519392208288","length":176},"id":"CVE-2022-3222-e8a296ba","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}