CVE-2022-32221
CVSS v3
9.8
CRITICAL
EPSS Score
1.8 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Technical details
- Published
- 2022-12-05
Frequently asked questions
What is CVE-2022-32221?
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Is CVE-2022-32221 actively exploited?
Active exploitation of CVE-2022-32221 has not been confirmed. The EPSS score is 1.8%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2022-32221?
CVE-2022-32221 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2022-32221 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2022 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).