CVE-2021-22898
curl 7.7 through 7.76.1 suffers from an information disclosure when the command line option, known as in libcurl, is used to send variable=content pairs to TELNET serv…
Published Jun 11, 2021 · updated Oct 14, 2026 · haxx curl
curl 7.7 through 7.76.1 suffers from an information disclosure when the command line option, known as in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
Timeline
Detection, updates, and resolution for this record.
Jun 11, 2021 · NIST NVD
Detected
curl 7.7 through 7.76.1 suffers from an information disclosure when the command line option, known as in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to
Oct 14, 2026 · NIST NVD
Updated
curl 7.7 through 7.76.1 suffers from an information disclosure when the command line option, known as in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to
Affected
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora33
- cpe fedoraproject/fedora34
- cpe haxx/curlversion unspecified
- cpe oracle/communications cloud native core binding support function1.11.0
- cpe oracle/communications cloud native core network function cloud native environment1.10.0
- cpe oracle/communications cloud native core network repository function1.15.0
- cpe oracle/communications cloud native core network repository function1.15.1
- cpe siemens/sinec infrastructure network servicesversion unspecified
- cpe splunk/universal forwarderversion unspecified
Sources
- CVE.orgCVE-2021-22898
Official CVE identifier
cve.org - NIST NVDCVE-2021-22898
curl 7.7 through 7.76.1 suffers from an information disclosure when the command line option, known as in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could
nvd.nist.gov