VDB
ALPINE-CVE-2022-32221
ALPINE-CVE-2022-32221
PUBLISHED
CVSS 9.800000190734863 CRITICAL
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.17 | curl | 0, 7.85.0-r0, 7.84.0-r2 |
| Alpine:v3.15 | curl | 7.21.4-r1, 0, 7.19.2-r0 |
| Alpine:v3.20 | curl | 7.64.0-r1, 7.28.1-r0, 7.28.0-r0 |
| Alpine:v3.22 | curl | 7.77.0-r1, 7.77.0-r0, 7.76.1-r0 |
| Alpine:v3.21 | curl | 7.45.0-r0, 0, 7.19.2-r0 |
| Alpine:v3.19 | curl | 7.31.0-r0, 7.32.0-r0, 7.33.0-r0 |
| Alpine:v3.16 | curl | 7.19.2-r0, 7.19.2-r1, 7.19.4-r0 |
| Alpine:v3.18 | curl | 7.52.1-r0, 0, 7.85.0-r0 |
| Alpine:v3.23 | curl | 7.85.0-r0, 0, 7.19.2-r0 |
| Alpine:v3.24 | curl | 0 |
Timeline
- Dec 5, 2022 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated