CVE-2022-27782

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Affected products

Alt Linux, Almalinux, Astra Linux, Centos, Ibm Aix, Linuxmint, Red Hat, Red Os

Haxx Curl

< 7.83.1

CVSS 3.1

7.5 HIGH

EPSS

2.8% (85th percentile)

Weakness

CWE-840, CWE-295

NVD status

Modified

Published

2022-06-01

No exploit for CVE-2022-27782 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.