ZeroDay Findings
Sign inSign up

Findings

CVE-2021-22946

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server ( on the command line or set to or wit…

Published Sep 29, 2021 · updated Oct 14, 2026 · haxx curl

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server ( on the command line or set to or withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 29, 2021 · NIST NVD

    Detected

    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server ( on the command line or set to or withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions

  2. Oct 14, 2026 · NIST NVD

    Updated

    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server ( on the command line or set to or withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora33
  • cpe fedoraproject/fedora35
  • cpe haxx/curlversion unspecified
  • cpe netapp/cloud backupversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/h300e firmwareversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified

Sources

  • CVE.orgCVE-2021-22946

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2021-22946

    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server ( on the command line or set to or withlibcurl). This requirement could be bypassed

    nvd.nist.gov

References