curl / Mailing Lists / curl-library / Single Mail
Buy commercial curl support from WolfSSL. We help you work out your issues, debug your libcurl applications, use the API, port to new platforms, add new features and more. With a team lead by the curl founder himself.

[SECURITY ADVISORY] CVE-2022-35252: control code in cookie denial of service (curl)

From: Daniel Stenberg via curl-library <>
Date: Wed, 31 Aug 2022 08:31:44 +0200 (CEST)

CVE-2022-35252: control code in cookie denial of service

Project curl Security Advisory, August 31 2022 -


When curl retrieves and parses cookies from an HTTP(S) server, it accepts
cookies using control codes (byte values below 32). When cookies that contain
such control codes are later sent back to an HTTP(S) server, it might make the
server return a 400 response. Effectively allowing a "sister site" to deny
service to siblings.

We are not aware of any exploit of this flaw.

This flaw in the code was initially introduced in curl 4.9 but HTTP(S) servers
back then did not generally reject requests using control codes so this
mistake did not actually cause problems until HTTP(S) servers started doing
this much later. Different server implementations of course doing it at
different times (with some also still accepting them just fine).
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2022-35252 to this issue.
CWE-1286: Improper Validation of Syntactic Correctness of Input
Severity: Low
- Affected versions: curl 4.9 to and including 7.84.0
- Not affected versions: curl < 4.9 and curl >= 7.85.0
libcurl is used by many applications, but not always advertised as such!
[fix for CVE-2022-35252](
  A - Upgrade curl to version 7.85.0
  B - Apply the patch to your local version
  C - Do not enable the cookie engine
This issue was reported to the curl project on June 26, 2022. We contacted
distros_at_openwall on August 22.
libcurl 7.85.0 was released on August 31 2022, coordinated with the
publication of this advisory.
- Reported-by: Axel Chong
- Patched-by: Daniel Stenberg
Thanks a lot!
  | Commercial curl support up to 24x7 is available!
  | Private help, bug fixes, support, ports, new features
Received on 2022-08-31