Information disclosure in https://github.com/curl/curl
Priority HIGH 82CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.05092 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 4 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | https://github.com/curl/curl | Fixed in 7.86.0 | — | No fix listed | CNA |
- https://github.com/curl/curl Vendor— Affected Fixed in 7.86.0 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | before 7.86.0 | Vulnerable | Haxx |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions before 7.86.0 Vulnerable ·Haxx
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | before 12.6.3 | Vulnerable | Apple |
| cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* | 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 | Vulnerable | Splunk |
| cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* | 9.1.0 | Vulnerable | Splunk |
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 12.6.3 Vulnerable ·Apple
- cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
- cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk
Remediation
Red Hat 4 advisories
- RHSA-2023:4139 Released 2023-07-18 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel-7.76.1-14.el9_0.6
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl-7.76.1-14.el9_0.6, curl-minimal-7.76.1-14.el9_0.6, libcurl-7.76.1-14.el9_0.6 +1
- RHSA-2023:0333 Released 2023-01-23 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-19.el9_1.1
- Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-19.el9_1.1, curl-minimal-7.76.1-19.el9_1.1, libcurl-7.76.1-19.el9_1.1 +1
- RHSA-2022:8841 Released 2022-12-08 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
- Red Hat JBoss Core Services
Show 1 more Red Hat advisories
- RHSA-2022:8840 Released 2022-12-08 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-7.86.0-2.el7jbcs, jbcs-httpd24-httpd-2.4.51-37.el7jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el7jbcs +15
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-7.86.0-2.el8jbcs, jbcs-httpd24-httpd-2.4.51-37.el8jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el8jbcs +15
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:0333 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:4139 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:0333 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.0) | Fixed | RHSA-2023:4139 |
| Red Hat JBoss Core Services | Fixed | RHSA-2022:8841 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2022:8840 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2022:8840 |
Not affected: 5 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat JBoss Core Services on RHEL 7 Server
- Red Hat JBoss Core Services on RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32221
- 2026-10-03 Alias added: GHSA-grfr-78m7-q35q
- 2026-10-09 Fix available: RHSA-2022:8841 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
References
Advisory 9
- GLSA-202212-01
- https://security.netapp.com/advisory/ntap-20230110-0006/
- https://support.apple.com/kb/HT213604
- https://support.apple.com/kb/HT213605
- 20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3
- 20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2
- DSA-5330
- [debian-lts-announce] 20230128 [SECURITY] [DLA 3288-1] curl security update
- https://security.netapp.com/advisory/ntap-20230208-0002/
Sources
- CVE-2022-32221 · CVE Program
- CVE-2022-32221 · NVD
- FIRST EPSS
- GHSA-grfr-78m7-q35q · GitHub Advisory Database · CC BY 4.0
- CVE-2022-32221 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences