TI-2021-05759 Aliases CVE-2021-22898 GHSA-7w8r-q58w-5wcr

Information disclosure in https://github.com/curl/curl

MEDIUM 48CWE-200Published 2021-06-11 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.04507 91st percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	https://github.com/curl/curl	7.7 through 7.76.1	—	No fix listed	CNA

https://github.com/curl/curl Vendor— Affected 7.7 through 7.76.1 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:curl::::::::	7.7 – 7.76.1	Vulnerable	Haxx
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:fedoraproject:fedora:33:::::::*	33	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:::::::*	1.11.0	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:::::::*	1.10.0	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:::::::*	1.15.0	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:::::::*	1.15.1	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:::::::*	1.8.0	Vulnerable	Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:::::::*	1.15.0	Vulnerable	Oracle

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.7 – 7.76.1 Vulnerable ·Haxx
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:* Versions 1.15.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle

Show 5 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:oracle:essbase::::::::	before 11.1.2.4.047; 21.0 to before 21.3	Vulnerable	Oracle
cpe:2.3:a:oracle:mysql_server::::::::	before 5.7.34; 8.0.15 to before 8.0.25	Vulnerable	Oracle
cpe:2.3:a:siemens:sinec_infrastructure_network_services::::::::	before 1.0.1.1	Vulnerable	Siemens
cpe:2.3:a:splunk:universal_forwarder::::::::	8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6	Vulnerable	Splunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:::::::*	9.1.0	Vulnerable	Splunk

cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:* Versions before 11.1.2.4.047; 21.0 to before 21.3 Vulnerable ·Oracle
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions before 5.7.34; 8.0.15 to before 8.0.25 Vulnerable ·Oracle
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* Versions before 1.0.1.1 Vulnerable ·Siemens
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk

Remediation

Red Hat 1 advisory

RHSA-2021:4511 Released 2021-11-09 · Red Hat rating Moderate
curl security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-22.el8, libcurl-7.61.1-22.el8, libcurl-devel-7.61.1-22.el8 +1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
.NET Core 2.1 on Red Hat Enterprise Linux	Affected	No fix planned: Will not fix
.NET Core 3.1 on Red Hat Enterprise Linux	Affected	No fix planned: Will not fix
Red Hat Ceph Storage 2	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Software Collections	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2021:4511

Not affected: 1 product

Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2021-22898
2026-10-03 Alias added: GHSA-7w8r-q58w-5wcr

References

Exploit 2

Patch 6

Advisory 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences