CVE-2021-22897
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use…
Published Jun 11, 2021 · updated Oct 14, 2026 · haxx curl
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Timeline
Detection, updates, and resolution for this record.
Jun 11, 2021 · NIST NVD
Detected
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the
Oct 14, 2026 · NIST NVD
Updated
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the
Affected
- cpe haxx/curlversion unspecified
- cpe netapp/cloud backupversion unspecified
- cpe netapp/h300e firmwareversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/hci compute node firmwareversion unspecified
- cpe oracle/communications cloud native core binding support function1.11.0
- cpe oracle/communications cloud native core network function cloud native environment1.10.0
- cpe oracle/communications cloud native core network repository function1.15.0
- cpe oracle/communications cloud native core network repository function1.15.1
- cpe oracle/communications cloud native core network slice selection function1.8.0
- cpe oracle/communications cloud native core service communication proxy1.15.0
- cpe oracle/essbaseversion unspecified
Sources
- CVE.orgCVE-2021-22897
Official CVE identifier
cve.org - NIST NVDCVE-2021-22897
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which
nvd.nist.gov