CVE-2022-32221
Estado: ModificadaCrítica (9.8)—
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 4.68%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
CWE
- CWE-200
- CWE-668
Referencias
- http://seclists.org/fulldisclosure/2023/Jan/19
- http://seclists.org/fulldisclosure/2023/Jan/20
- http://www.openwall.com/lists/oss-security/2023/05/17/4
- https://hackerone.com/reports/1704017
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20230110-0006/
- https://security.netapp.com/advisory/ntap-20230208-0002/
- https://support.apple.com/kb/HT213604
- https://support.apple.com/kb/HT213605
- https://www.debian.org/security/2023/dsa-5330
- http://seclists.org/fulldisclosure/2023/Jan/19
- http://seclists.org/fulldisclosure/2023/Jan/20
- http://www.openwall.com/lists/oss-security/2023/05/17/4
- https://hackerone.com/reports/1704017
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20230110-0006/
- https://security.netapp.com/advisory/ntap-20230208-0002/
- https://support.apple.com/kb/HT213604
- https://support.apple.com/kb/HT213605
- https://www.debian.org/security/2023/dsa-5330
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-32221",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-32221",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-05-20T15:51:51.662523Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "support@hackerone.com",
"affectedData": [
{
"vendor": "n/a",
"product": "https://github.com/curl/curl",
"versions": [
{
"status": "affected",
"version": "Fixed in 7.86.0"
}
]
}
]
}
],
"published": "2022-12-05T22:15:10.343",
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jan/19",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Jan/20",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/05/17/4",
"tags": [
"Mailing List"
],
"source": "support@hackerone.com"
},
{
"url": "https://hackerone.com/reports/1704017",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://security.gentoo.org/glsa/202212-01",
"tags": [
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230110-0006/",
"tags": [
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230208-0002/",
"tags": [
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://support.apple.com/kb/HT213604",
"tags": [
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://support.apple.com/kb/HT213605",
"tags": [
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://www.debian.org/security/2023/dsa-5330",
"tags": [
"Third Party Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Jan/19",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Jan/20",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/05/17/4",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://hackerone.com/reports/1704017",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/202212-01",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230110-0006/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230208-0002/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/kb/HT213604",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/kb/HT213605",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2023/dsa-5330",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "support@hackerone.com",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-668"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST."
},
{
"lang": "es",
"value": "Al realizar transferencias HTTP(S), libcurl podría usar erróneamente la devolución de llamada de lectura (`CURLOPT_READFUNCTION`) para solicitar datos para enviar, incluso cuando se haya configurado la opción `CURLOPT_POSTFIELDS`, si anteriormente se usó el mismo identificador para emitir un `PUT `solicitud que utilizó esa devolución de llamada. Esta falla puede sorprender a la aplicación y hacer que se comporte mal y envíe datos incorrectos o use memoria después de liberarla o algo similar en la solicitud \"POST\" posterior. El problema existe en la lógica de un identificador reutilizado cuando se cambia de PUT a POST."
}
],
"lastModified": "2026-06-17T04:46:54.347",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D934A596-F199-43E2-9E68-EBCF33B687D4",
"versionEndExcluding": "7.86.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FE996B1-6951-4F85-AA58-B99A379D2163"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6770B6C3-732E-4E22-BF1C-2D2FD610061C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9F9C8C20-42EB-4AB5-BD97-212DEB070C43"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7FFF7106-ED78-49BA-9EC5-B889E3685D53"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E63D8B0F-006E-4801-BF9D-1C001BBFB4F9"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56409CEC-5A1E-4450-AA42-641E459CC2AF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B06F4839-D16A-4A61-9BB5-55B13F41E47F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0B4AD8A-F172-4558-AEC6-FF424BA2D912"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8497A4C9-8474-4A62-8331-3FE862ED4098"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4459FCD-53C3-4BD1-9744-4B340113434D",
"versionEndExcluding": "12.6.3"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5722E753-75DE-4944-A11B-556CB299B57D",
"versionEndExcluding": "8.2.12",
"versionStartIncluding": "8.2.0"
},
{
"criteria": "cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC0F9351-81A4-4FEA-B6B5-6E960A933D32",
"versionEndExcluding": "9.0.6",
"versionStartIncluding": "9.0.0"
},
{
"criteria": "cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EED24E67-2957-4C1B-8FEA-E2D2FE7B97FC"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "support@hackerone.com"
}