CVE-2022-32221
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Published:Oct 26, 2022
Last Modified:Feb 13, 2026
EPS:Dec 5, 2022
EPSS Score:0.02128
CVSS Score:9.8
Affected Products
Vendor
Product
Action
Vendor
Apple
Product
Macos
Apple
Macos
Vendor
Debian
Product
Debian Linux
Debian
Debian Linux
Vendor
Haxx
Product
Curl
Haxx
Curl
Vendor
Netapp
Product
Clustered Data Ontap
Netapp
Clustered Data Ontap
Vendor
Netapp
Product
H300s
Netapp
H300s
Vendor
Netapp
Product
H300s Firmware
Netapp
H300s Firmware
Vendor
Netapp
Product
H410s
Netapp
H410s
Vendor
Netapp
Product
H410s Firmware
Netapp
H410s Firmware
Vendor
Netapp
Product
H500s
Netapp
H500s
Vendor
Netapp
Product
H500s Firmware
Netapp
H500s Firmware
Vendor
Netapp
Product
H700s
Netapp
H700s
Vendor
Netapp
Product
H700s Firmware
Netapp
H700s Firmware
Vendor
Redhat
Product
Enterprise Linux
Redhat
Enterprise Linux
Vendor
Redhat
Product
Jboss Core Services
Redhat
Jboss Core Services
Vendor
Redhat
Product
Rhel Eus
Redhat
Rhel Eus
Vendor
Splunk
Product
Universal Forwarder
Splunk
Universal Forwarder
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
