Read the docs
TI-2021-05751 Aliases CVE-2021-22890GHSA-5cwr-528x-3vwc

Authentication bypass by spoofing in https://github.com/curl/curl

Priority MEDIUM 53CWE-300Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-290.

Summary

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03057 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/curl/curl7.63.0 to and including 7.75.0—No fix listedCNA
  • https://github.com/curl/curl Vendor— Affected 7.63.0 to and including 7.75.0 Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*7.63.0 – 7.75.0VulnerableHaxx
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*not specified by NVDVulnerableBroadcom
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*before 1.0.1.1VulnerableSiemens
  • cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* Versions 7.63.0 – 7.75.0 Vulnerable ·Haxx
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* Versions before 1.0.1.1 Vulnerable ·Siemens
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*21.2VulnerableOracle
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6VulnerableSplunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableSplunk
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* Versions 21.2 Vulnerable ·Oracle
  • cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
  • cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk

Remediation

Red Hat 2 advisories

  • RHSA-2021:2472 Released 2021-06-17 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-1-18.jbcs.el7, jbcs-httpd24-apr-1.6.3-105.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-105.jbcs.el7 +31
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-1-18.el8jbcs, jbcs-httpd24-apr-1.6.3-105.el8jbcs, jbcs-httpd24-apr-devel-1.6.3-105.el8jbcs +42
  • RHSA-2021:2471 Released 2021-06-17 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update
    • JBoss Core Services Apache HTTP Server 2.4.37 SP8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    https://github.com/curl/curl — FEDORA-2021-26a293c72b

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-05737 Information disclosure in https://github.com/curl/curlPriority MEDIUM 63
    Show all 2 records → Advisory →
  • Advisory ·

    https://github.com/curl/curl — FEDORA-2021-cab5c9befb

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-05737 Information disclosure in https://github.com/curl/curlPriority MEDIUM 63
    Show all 2 records → Advisory →
Show 2 more groups
  • Advisory ·

    https://github.com/curl/curl — FEDORA-2021-065371f385

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-05737 Information disclosure in https://github.com/curl/curlPriority MEDIUM 63
    Show all 2 records → Advisory →
  • Advisory ·

    https://github.com/curl/curl — GLSA-202105-36

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-05737 Information disclosure in https://github.com/curl/curlPriority MEDIUM 63
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
JBoss Core Services Apache HTTP Server 2.4.37 SP8Fixed RHSA-2021:2471
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2021:2472
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2021:2472
Not affected: 7 products
  • .NET Core 2.1 on Red Hat Enterprise Linux
  • .NET Core 3.1 on Red Hat Enterprise Linux
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22890
  2. 2026-10-03 Alias added: GHSA-5cwr-528x-3vwc

References

Exploit 1

Patch 2

Advisory 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences