ZeroDay Findings
Sign inSign up

Findings

CVE-2022-32208

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.

Published Jul 7, 2022 · updated Oct 14, 2026 · haxx curl

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 7, 2022 · NIST NVD

    Detected

    When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

  2. Oct 14, 2026 · NIST NVD

    Updated

    When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe fedoraproject/fedora35
  • cpe haxx/curlversion unspecified
  • cpe netapp/bootstrap osversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/element softwareversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/solidfireversion unspecified

Sources

  • CVE.orgCVE-2022-32208

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2022-32208

    When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

    nvd.nist.gov

References