CVE-2022-32206
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms.
Published Jul 7, 2022 · updated Oct 14, 2026 · haxx curl
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
Timeline
Detection, updates, and resolution for this record.
Jul 7, 2022 · NIST NVD
Detected
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bo
Oct 14, 2026 · NIST NVD
Updated
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bo
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe fedoraproject/fedora35
- cpe haxx/curlversion unspecified
- cpe netapp/bootstrap osversion unspecified
- cpe netapp/clustered data ontapversion unspecified
- cpe netapp/element softwareversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/h700s firmwareversion unspecified
- cpe netapp/hci management nodeversion unspecified
- cpe netapp/solidfireversion unspecified
Sources
- CVE.orgCVE-2022-32206
Official CVE identifier
cve.org - NIST NVDCVE-2022-32206
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to ins
nvd.nist.gov