CVE-2022-32221 : faille critique haxx curl (CVSS 9.8)

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Sévérité

Critique (CVSS 9.8)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation active

Non signalée par la CISA

Publication

5 déc. 2022

Dernière mise à jour

17 juin 2026

• haxx curl
• netapp clustered data ontap
• netapp h300s firmware
• netapp h500s firmware
• netapp h700s firmware
• netapp h410s firmware
• debian debian linux
• apple macos
• splunk universal forwarder

• Fiche CVE-2022-32221 sur le NVD (NIST)
• seclists.org/fulldisclosure/2023/Jan/19
• seclists.org/fulldisclosure/2023/Jan/20
• openwall.com/lists/oss-security/2023/05/17/4
• hackerone.com/reports/1704017
• lists.debian.org/debian-lts-announce/2023/01/msg00028.html
• security.gentoo.org/glsa/202212-01
• security.netapp.com/advisory/ntap-20230110-0006/
• security.netapp.com/advisory/ntap-20230208-0002/
• support.apple.com/kb/HT213604
• support.apple.com/kb/HT213605
• debian.org/security/2023/dsa-5330