{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"6.1.2"},{"introduced":"6.2.0","last_affected":"6.4.0-alpha1"}],"component":"github.com/pingcap/tidb","cve_ids":["CVE-2022-3023"],"ecosystem":"Go","epss":0.0068,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7fxj-fr3v-r9gj","id":"tcs_01M5KF1WKV39SFBHK41BNYYQT8","modified_at":"2026-09-10T03:49:46.994032003Z","published_at":"2022-11-04T19:01:17Z","references":["https://osv.dev/vulnerability/GHSA-7fxj-fr3v-r9gj","https://nvd.nist.gov/vuln/detail/CVE-2022-3023","https://github.com/pingcap/tidb/commit/d0376379d615cc8f263a0b17c031ce403c8dcbfb","https://advisory.dw1.io/45","https://github.com/pingcap/tidb","https://huntr.dev/bounties/120f1346-e958-49d0-b66c-0f889a469540"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-7fxj-fr3v-r9gj","url":"https://osv.dev/vulnerability/GHSA-7fxj-fr3v-r9gj"}],"summary":"TiDB vulnerable to Use of Externally-Controlled Format String"}