TI-2021-05737 Aliases CVE-2021-22876 GHSA-jjr6-2g8j-hmwr

Information disclosure in https://github.com/curl/curl

MEDIUM 63CWE-359Published 2021-04-01 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 7 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-359.

Summary

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.05301 92nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 4 advisoriesRed Hat: 7 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	https://github.com/curl/curl	7.1.1 to and including 7.75.0	—	No fix listed	CNA

https://github.com/curl/curl Vendor— Affected 7.1.1 to and including 7.75.0 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:libcurl::::::::	7.1.1 – 7.75.0	Vulnerable	Haxx
cpe:2.3:o:fedoraproject:fedora:32:::::::*	32	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:33:::::::*	33	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject
cpe:2.3:a:netapp:hci_management_node:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:solidfire:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:hci_compute_node:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:hci_storage_node:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:o:broadcom:fabric_operating_system:-:::::::*	not specified by NVD	Vulnerable	Broadcom
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian

cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* Versions 7.1.1 – 7.75.0 Vulnerable ·Haxx
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Show 5 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:sinec_infrastructure_network_services::::::::	before 1.0.1.1	Vulnerable	Siemens
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:::::::*	12.0.0.3.0	Vulnerable	Oracle
cpe:2.3:a:oracle:essbase:21.2:::::::*	21.2	Vulnerable	Oracle
cpe:2.3:a:splunk:universal_forwarder::::::::	8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6	Vulnerable	Splunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:::::::*	9.1.0	Vulnerable	Splunk

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* Versions before 1.0.1.1 Vulnerable ·Siemens
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* Versions 21.2 Vulnerable ·Oracle
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk

Remediation

Red Hat 4 advisories

RHSA-2022:1354 Released 2022-04-13 · Red Hat rating Moderate
rh-dotnet31-curl security update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-curl-7.61.1-22.el7_9, rh-dotnet31-libcurl-7.61.1-22.el7_9, rh-dotnet31-libcurl-devel-7.61.1-22.el7_9
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-curl-7.61.1-22.el7_9, rh-dotnet31-libcurl-7.61.1-22.el7_9, rh-dotnet31-libcurl-devel-7.61.1-22.el7_9
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-curl-7.61.1-22.el7_9, rh-dotnet31-libcurl-7.61.1-22.el7_9, rh-dotnet31-libcurl-devel-7.61.1-22.el7_9
RHSA-2021:4511 Released 2021-11-09 · Red Hat rating Moderate
curl security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-22.el8, libcurl-7.61.1-22.el8, libcurl-devel-7.61.1-22.el8 +1
RHSA-2021:2472 Released 2021-06-17 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-1-18.jbcs.el7, jbcs-httpd24-apr-1.6.3-105.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-105.jbcs.el7 +31
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-1-18.el8jbcs, jbcs-httpd24-apr-1.6.3-105.el8jbcs, jbcs-httpd24-apr-devel-1.6.3-105.el8jbcs +42

Show 1 more Red Hat advisories

RHSA-2021:2471 Released 2021-06-17 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update
- JBoss Core Services Apache HTTP Server 2.4.37 SP8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2021-04-01
https://github.com/curl/curl — FEDORA-2021-26a293c72b
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2021-05751 Authentication bypass by spoofing in https://github.com/curl/curlPriority MEDIUM 53
Show all 2 records → Advisory →
Advisory · 2021-04-01
https://github.com/curl/curl — FEDORA-2021-cab5c9befb
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2021-05751 Authentication bypass by spoofing in https://github.com/curl/curlPriority MEDIUM 53
Show all 2 records → Advisory →

Show 2 more groups

Advisory · 2021-04-01
https://github.com/curl/curl — FEDORA-2021-065371f385
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2021-05751 Authentication bypass by spoofing in https://github.com/curl/curlPriority MEDIUM 53
Show all 2 records → Advisory →
Advisory · 2021-04-01
https://github.com/curl/curl — GLSA-202105-36
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2021-05751 Authentication bypass by spoofing in https://github.com/curl/curlPriority MEDIUM 53
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
.NET Core 2.1 on Red Hat Enterprise Linux	Affected	No fix planned: Will not fix
Red Hat Ceph Storage 2	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Software Collections	Affected	No fix planned: Will not fix
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7)	Fixed	RHSA-2022:1354
.NET Core on Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2022:1354
.NET Core on Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2022:1354
JBoss Core Services Apache HTTP Server 2.4.37 SP8	Fixed	RHSA-2021:2471
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2021:4511
Red Hat JBoss Core Services on RHEL 7 Server	Fixed	RHSA-2021:2472
Red Hat JBoss Core Services on RHEL 8	Fixed	RHSA-2021:2472

Not affected: 1 product

Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2021-22876
2026-10-03 Alias added: GHSA-jjr6-2g8j-hmwr

References

Exploit 1

https://hackerone.com/reports/1101882

Patch 2

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences