All vulnerabilities

Servers and applications

CVE-2021-22924

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but…

Severity
Low 3.7
Published
5 Aug 2021
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.77.0
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:libcurl
  • From 7.10.4 before 7.77.0
MySQLServers and applications · cpe:a:oracle:mysql_server
  • From 5.7.0 up to 5.7.36
  • From 8.0.0 up to 8.0.26

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-22924
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-22924