curl / Docs / Vulnerability table / 7.78.0 vulnerabilities

Vulnerabilities in curl 7.78.0

Related:
Bug Bounty
Changelog
Donate
FAQ
Security Problems
Security Process
Vulnerabilities Table

curl version 7.78.0 was released on July 21 2021. The following 19 security problems are known to exist in this version.

Flaw	From version	To and including	CVE	CWE
HTTP Proxy deny use-after-free	7.16.0	7.86.0	CVE-2022-43552	CWE-416: Use After Free
Another HSTS bypass via IDN	7.77.0	7.86.0	CVE-2022-43551	CWE-319: Cleartext Transmission of Sensitive Information
HSTS bypass via IDN	7.77.0	7.85.0	CVE-2022-42916	CWE-319: Cleartext Transmission of Sensitive Information
HTTP proxy double-free	7.77.0	7.85.0	CVE-2022-42915	CWE-415: Double Free
POST following PUT confusion	7.7	7.85.0	CVE-2022-32221	CWE-440: Expected Behavior Violation
control code in cookie denial of service	4.9	7.84.0	CVE-2022-35252	CWE-1286: Improper Validation of Syntactic Correctness of Input
FTP-KRB bad message verification	7.16.4	7.83.1	CVE-2022-32208	CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Unpreserved file permissions	7.69.0	7.83.1	CVE-2022-32207	CWE-281: Improper Preservation of Permissions
HTTP compression denial of service	7.57.0	7.83.1	CVE-2022-32206	CWE-770: Allocation of Resources Without Limits or Throttling
Set-Cookie denial of service	7.71.0	7.83.1	CVE-2022-32205	CWE-770: Allocation of Resources Without Limits or Throttling
TLS and SSH connection too eager reuse	7.16.1	7.83.0	CVE-2022-27782	CWE-305: Authentication Bypass by Primary Weakness
CERTINFO never-ending busy-loop	7.34.0	7.83.0	CVE-2022-27781	CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Auth/cookie leak on redirect	4.9	7.82.0	CVE-2022-27776	CWE-522: Insufficiently Protected Credentials
Bad local IPv6 connection reuse	7.65.0	7.82.0	CVE-2022-27775	CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Credential leak on redirect	4.9	7.82.0	CVE-2022-27774	CWE-522: Insufficiently Protected Credentials
OAUTH2 bearer bypass in connection re-use	7.33.0	7.82.0	CVE-2022-22576	CWE-305: Authentication Bypass by Primary Weakness
STARTTLS protocol injection via MITM	7.20.0	7.78.0	CVE-2021-22947	CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
Protocol downgrade required TLS bypassed	7.20.0	7.78.0	CVE-2021-22946	CWE-325: Missing Cryptographic Step
UAF and double-free in MQTT sending	7.73.0	7.78.0	CVE-2021-22945	CWE-415: Double Free

Changelog for curl 7.78.0

See vulnerability summary for the previous release: 7.77.0 or the subsequent release: 7.79.0