TI-2022-21331 Aliases CVE-2022-43551 GHSA-25m2-mpq4-29vh

Cleartext transmission of sensitive information in https://github.com/curl/curl

HIGH 72CWE-319Published 2022-12-23 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-319.

Summary

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.16598 97th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	https://github.com/curl/curl	Fixed in curl 7.87.0	—	No fix listed	CNA

https://github.com/curl/curl Vendor— Affected Fixed in curl 7.87.0 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:curl::::::::	7.77.0 to before 7.87.0	Vulnerable	Haxx
cpe:2.3:o:fedoraproject:fedora:37:::::::*	37	Vulnerable	Fedoraproject
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:oncommand_insight:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:snapcenter:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:splunk:universal_forwarder::::::::	8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6	Vulnerable	Splunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:::::::*	9.1.0	Vulnerable	Splunk

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.77.0 to before 7.87.0 Vulnerable ·Haxx
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.12; 9.0.0 to before 9.0.6 Vulnerable ·Splunk
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Splunk

Remediation

Red Hat 2 advisories

RHSA-2023:3354 Released 2023-06-05 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el7jbcs +23
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el8jbcs +23
RHSA-2023:3355 Released 2023-06-05 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
- JBCS httpd 2.4.51.sp2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
JBCS httpd 2.4.51.sp2	Fixed	RHSA-2023:3355
Red Hat JBoss Core Services on RHEL 7 Server	Fixed	RHSA-2023:3354
Red Hat JBoss Core Services on RHEL 8	Fixed	RHSA-2023:3354

Not affected: 5 products

.NET Core 3.1 on Red Hat Enterprise Linux
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Core Services on RHEL 7 Server
Red Hat JBoss Core Services on RHEL 8

Timeline

2026-10-02 Threatist record created from CVE-2022-43551
2026-10-03 Alias added: GHSA-25m2-mpq4-29vh
2026-10-09 Fix available: RHSA-2023:3355 · Red Hat
2026-10-16 Fix available: JBCS httpd 2.4.51.sp2 · Red Hat

References

Exploit 1

https://hackerone.com/reports/1755083

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences