VDB

DEBIAN-CVE-2022-32221

DEBIAN-CVE-2022-32221 PUBLISHED CVSS 9.800000190734863 CRITICAL

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Risk Scores

CVSS v3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Debian:14curl0, 0, 0
Debian:11curl7.74.0-1.3, 0, 7.74.0-1.3
Debian:13curl0, 0, 0
Debian:12curl0, 0, 0

Timeline

  • Dec 5, 2022 CVE Published
  • Apr 28, 2026 CVE Updated
Open in Interactive Console →
$ Console Community · 100/wk Open console ›