Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2022-36104: TYPO3 CMS can crash from malformed page requests
CVE-2022-36104 · published 4 years ago
Summary
The TYPO3 content management system may run out of server resources when it receives an invalid or missing page request, causing the site to become unresponsive. This happens because the error handler repeatedly calls the same page, exhausting the server. Update your TYPO3 installation to version 11.5.16 as soon as possible to prevent the issue.
What to do
- Update typo3 cms-core to version 11.5.16.
- Update typo3 cms to version 11.5.16.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | typo3 | cms-core |
>= 11.4.0, < 11.5.16 Fix: upgrade to 11.5.16
|
| composer | typo3 | cms |
>= 11.4.0, < 11.5.16 Fix: upgrade to 11.5.16
|
| – | typo3 | typo3 |
>= 11.4.0, <= 11.5.15 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* |
Original advisory text
Denial of Service via Page Error Handling in TYPO3/cms
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.
References
- https://github.com/TYPO3/typo3/commit/fc51ccbf2bb8a8c959aa74cbceca124971e6e7fd
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/C...
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-20...
- https://github.com/advisories/GHSA-fffr-7x4x-f98q
- https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-36104 Vendor Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2022-006 Vendor Advisory
- https://github.com/TYPO3/typo3/commit/179dd7cd78947081d573fee2050e197faa556f13 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36104... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published13 Sep 2022
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta