Security readout for executives and security teams
Plain-English summary
CVE-2022-31110 is a denial-of-service issue in RSSHub. Certain `filter` and `filterout` parameter values can drive unusually high CPU use, degrading RSSHub performance or availability. It affects commits before the fixed commit and has no known workaround in the provided advisory.
Executive priority
Treat this as a moderate availability risk. It is unlikely to expose data based on the CVSS impact, but public RSSHub services should be upgraded promptly to prevent avoidable performance degradation or outage.
Technical view
RSSHub before commit 5c4177441417b44a6e45c3c63e9eac2504abeb5b is vulnerable to uncontrolled resource consumption, tracked as CWE-400. CVSS 3.1 is 5.3: network exploitable, low complexity, no privileges, no user interaction, and limited availability impact only.
Likely exposure
Exposure is most likely for internet-accessible RSSHub deployments running source builds or containers based on commits before 5c4177441417b44a6e45c3c63e9eac2504abeb5b. The bundle provides no CPEs or named packaged versions.
Exploitation context
The source bundle does not cite active exploitation, and KEV is false. The CVSS vector indicates unauthenticated network reachability, but the sources do not provide exploit prevalence, scanning activity, or weaponized details.
Researcher notes
The evidence is strongest for affected range, root impact, and fixed commit. It is incomplete for exploit activity, affected packaged versions, and compensating controls. Avoid asserting more than resource-exhaustion DoS without additional vendor evidence.
Mitigation direction
- Upgrade RSSHub to a build containing commit 5c4177441417b44a6e45c3c63e9eac2504abeb5b.
- Check the GitHub advisory for any later vendor guidance or release mapping.
- Prioritize public RSSHub instances because the CVSS vector is network-based and unauthenticated.
- Do not rely on a workaround; the advisory states none are known.
Validation and detection
- Inventory RSSHub deployments and identify their deployed commit or image provenance.
- Confirm the fixed commit is present in the running codebase or container image.
- Review monitoring for abnormal CPU spikes affecting RSSHub service availability.
- Check access logs for unusual use of `filter` or `filterout` parameters.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31110 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DIYgod/RSSHub/security/advisories/GHSA-jvxx-v45p-v5vfCVE reference · x_refsource_CONFIRM
- https://github.com/DIYgod/RSSHub/issues/10045CVE reference · x_refsource_MISC
- https://github.com/DIYgod/RSSHub/commit/5c4177441417b44a6e45c3c63e9eac2504abeb5bCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.