Resource allocation without limits in https://github.com/curl/curl
Priority MEDIUM 53CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-770.
Summary
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.31497 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | https://github.com/curl/curl | Fixed in 7.84.0 | — | No fix listed | CNA |
- https://github.com/curl/curl Vendor— Affected Fixed in 7.84.0 Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | 7.71.0 to before 7.84.0 | Vulnerable | Haxx |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.71.0 to before 7.84.0 Vulnerable ·Haxx
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | before 13.0 | Vulnerable | Apple |
| cpe:2.3:o:siemens:scalance_sc622-2c_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_sc622-2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_sc626-2c_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_sc626-2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_sc632-2c_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_sc632-2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_sc636-2c_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_sc636-2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_sc642-2c_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_sc642-2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_sc646-2c_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_sc646-2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* | 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 | Vulnerable | Splunk |
| cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* | 9.1.0 | Vulnerable | Splunk |
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 13.0 Vulnerable ·Apple
- cpe:2.3:o:siemens:scalance_sc622-2c_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_sc622-2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_sc626-2c_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_sc626-2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_sc632-2c_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_sc632-2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_sc636-2c_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_sc636-2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_sc642-2c_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_sc642-2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_sc646-2c_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_sc646-2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
- cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
https://github.com/curl/curl — FEDORA-2022-1b3d7f6973
4 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM
Other records, highest priority first
- TI-2022-13917 Incorrect default permissions in https://github.com/curl/curlPriority HIGH 82
- TI-2022-13916 Resource allocation without limits in https://github.com/curl/curlPriority MEDIUM 62
- TI-2022-13918 Out-of-bounds write in https://github.com/curl/curlPriority MEDIUM 60
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 7 products
- .NET Core 3.1 on Red Hat Enterprise Linux
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32205
- 2026-10-03 Alias added: GHSA-9hhr-r3j8-h675
References
Sources
- CVE-2022-32205 · CVE Program
- CVE-2022-32205 · NVD
- FIRST EPSS
- GHSA-9hhr-r3j8-h675 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-32205 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences