ZeroDay Findings
Sign inSign up

Findings

CVE-2022-32221

When doing HTTP(S) transfers, libcurl might erroneously use the read callback ( ) to ask for data to send, even when the option has been set, if the same handle previo…

Published Dec 5, 2022 · updated Oct 14, 2026 · haxx curl

When doing HTTP(S) transfers, libcurl might erroneously use the read callback ( ) to ask for data to send, even when the option has been set, if the same handle previously was used to issue a request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 5, 2022 · NIST NVD

    Detected

    When doing HTTP(S) transfers, libcurl might erroneously use the read callback ( ) to ask for data to send, even when the option has been set, if the same handle previously was used to issue a request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent request. The problem

  2. Oct 14, 2026 · NIST NVD

    Updated

    When doing HTTP(S) transfers, libcurl might erroneously use the read callback ( ) to ask for data to send, even when the option has been set, if the same handle previously was used to issue a request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent request. The problem

Affected

  • cpe apple/macosversion unspecified
  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe haxx/curlversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h410s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe splunk/universal forwarderversion unspecified

Sources

  • CVE.orgCVE-2022-32221

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2022-32221

    When doing HTTP(S) transfers, libcurl might erroneously use the read callback ( ) to ask for data to send, even when the option has been set, if the same handle previously was used to issue a request which used that callback. This f

    nvd.nist.gov

References