CVE-2022-32221

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Affected products

Alt Linux, Almalinux, Astra Linux, Ibm Aix, Linuxmint, Apple Macos, Mysql Server, Red Hat

Haxx Curl

< 7.86.0

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

4.3% (90th percentile)

Weakness

CWE-200, CWE-668

NVD status

Modified

Published

2022-12-05

No exploit for CVE-2022-32221 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.