CVE-2022-31622 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

## Description

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.

## Metrics

CVSS 3.15.5/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Probability 0.22%

12.2th percentile

Probability of exploitation in the next 30 days. [Learn more](https://www.first.org/epss/)

## Weakness Enumeration

- [CWE-667](https://cwe.mitre.org/data/definitions/667.html)

## Affected Software

| Vendor  | Product  | Versions                    |
|---------|----------|-----------------------------|
| Mariadb | Mariadb  | < 10.2.42                    |
| Mariadb | Mariadb  | >= 10.3.0, < 10.3.33        |
| Mariadb | Mariadb  | >= 10.4.0, < 10.4.23        |
| Mariadb | Mariadb  | >= 10.5.0, < 10.5.14        |
| Mariadb | Mariadb  | >= 10.6.0, < 10.6.6         |
| Mariadb | Mariadb  | >= 10.7.0, < 10.7.2         |

## References

- [Patch](https://github.com/MariaDB/server/commit/e1eb39a446c30b8459c39fd7f2ee1c55a36e97d2), Third Party Advisory

- [Issue Tracking](https://jira.mariadb.org/browse/MDEV-26561)

- [Issue Tracking](https://jira.mariadb.org/browse/MDEV-26561?filter=-2), Permissions Required, Third Party Advisory

- [Issue Tracking](https://jira.mariadb.org/browse/MDEV-26574)

- [Third Party Advisory](https://security.netapp.com/advisory/ntap-20220707-0006/)

## Timeline

Published: May 25, 2022

Last Modified: Jun 17, 2026

Status: Modified

## Frequently Asked Questions

**What is CVE-2022-31622?**  
MariaDB Server before 10.7 is vulnerable to Denial of Service in the way described above.

**How severe is CVE-2022-31622?**  
CVE-2022-31622 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

**How do I fix CVE-2022-31622?**  
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also [run a Strix scan](https://app.strix.ai/) to test if your systems are affected.