CVE-2021-22565

—

CVSS 3.1

6.5 medium

EPSS

<1%p36

Published

Dec 9, 2021 (Dec 9, 2021)

Modified

Jun 17, 2026

Description

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

Vendors: google
Products: exposure notification verification server
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.