All vulnerabilities

Servers and applications

CVE-2022-32221

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free…

Severity
Critical 9.8
Published
5 Dec 2022
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.86.0
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • Every version before 7.86.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-32221
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-32221