CVE Feed

    Dashboard / CVE / CVE-2021-22946

    CVE-2021-22946

    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

    Published:Sep 15, 2021
    Last Modified:Apr 16, 2026
    EPS:Sep 29, 2021
    EPSS Score:0.00078
    CVSS Score:7.5

    Affected Products

    Vendor
    Apple
    Product
    Macos
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Haxx
    Product
    Curl
    Vendor
    Netapp
    Product
    Cloud Backup
    Vendor
    Netapp
    Product
    Clustered Data Ontap
    Vendor
    Netapp
    Product
    H300e
    Vendor
    Netapp
    Product
    H300e Firmware
    Vendor
    Netapp
    Product
    H300s
    Vendor
    Netapp
    Product
    H300s Firmware
    Vendor
    Netapp
    Product
    H410s
    Vendor
    Netapp
    Product
    H410s Firmware
    Vendor
    Netapp
    Product
    H500e
    Vendor
    Netapp
    Product
    H500e Firmware
    Vendor
    Netapp
    Product
    H500s
    Vendor
    Netapp
    Product
    H500s Firmware
    Vendor
    Netapp
    Product
    H700e
    Vendor
    Netapp
    Product
    H700e Firmware
    Vendor
    Netapp
    Product
    H700s
    Vendor
    Netapp
    Product
    H700s Firmware
    Vendor
    Netapp
    Product
    Oncommand Insight
    Vendor
    Netapp
    Product
    Oncommand Workflow Automation
    Vendor
    Netapp
    Product
    Snapcenter
    Vendor
    Netapp
    Product
    Solidfire Baseboard Management Controller
    Vendor
    Netapp
    Product
    Solidfire Baseboard Management Controller Firmware
    Vendor
    Oracle
    Product
    Commerce Guided Search
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Binding Support Function
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Console
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Network Function Cloud Native Environment
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Network Repository Function
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Network Slice Selection Function
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Security Edge Protection Proxy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Service Communication Proxy
    Vendor
    Oracle
    Product
    Mysql Server
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Dotnet
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Siemens
    Product
    Sinec Infrastructure Network Services
    Vendor
    Splunk
    Product
    Universal Forwarder

    Exploits

    https://hackerone.com/reports/1334111https://hackerone.com/reports/1334111

    Related CVEs

    CVE-2026-87546 (CVSS 4.3) — Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a …
    CVE-2026-87470 (CVSS 9.6) — Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attack…
    CVE-2026-87637 (CVSS 9.6) — Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to ex…
    CVE-2026-87535 (CVSS 6.5) — Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remot…
    CVE-2026-87452 (CVSS 3.1) — Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who…
    CVE-2026-87562 (CVSS 4.3) — Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a re…
    CVE-2026-87558 (CVSS 9.6) — Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to exec…
    CVE-2026-87607 (CVSS 9.6) — Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potent…
    CVE-2026-81984 (CVSS 5.5) — Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory…
    CVE-2026-81989 (CVSS 7.8) — Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in …

    References

    http://seclists.org/fulldisclosure/2022/Mar/29
    https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
    https://hackerone.com/reports/1334111
    https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html
    https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
    https://security.gentoo.org/glsa/202212-01
    https://security.netapp.com/advisory/ntap-20211029-0003/
    https://security.netapp.com/advisory/ntap-20220121-0008/
    https://support.apple.com/kb/HT213183
    https://www.debian.org/security/2022/dsa-5197
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    http://seclists.org/fulldisclosure/2022/Mar/29
    https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
    https://hackerone.com/reports/1334111
    https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html
    https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
    https://security.gentoo.org/glsa/202212-01
    https://security.netapp.com/advisory/ntap-20211029-0003/
    https://security.netapp.com/advisory/ntap-20220121-0008/
    https://support.apple.com/kb/HT213183
    https://www.debian.org/security/2022/dsa-5197
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High