CVE-2022-27782
HighSummary
libcurl has an issue with reusing previously created connections even when TLS or SSH-related options have been changed that should prohibit reuse. Several TLS and SSH settings were left out from the configuration match checks, making them match too easily.
Risk Assessment
Organizations may be exposed to attacks that exploit improper connection reuse, potentially leading to unauthorized access to data or services. Changes to TLS and SSH settings are not properly enforced, increasing the risk.
Recommendation
It is recommended to update the libcurl library to the latest version to resolve the connection reuse issue and review TLS and SSH settings to ensure proper configuration.
Other vulnerabilities in libcurl
See all- CVE-2022-27781High
libcurl provides the `CURLOPT_CERTINFO` option to allow applications to request details about a server's certificate chain. Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that information.
- CVE-2021-22926High
libcurl-using applications can request a specific client certificate to be used in a transfer. When built with the macOS native TLS library Secure Transport, a malicious user can trick the application into using a file-based certificate instead of the intended one, leading to the wrong client certificate being sent in the TLS handshake.
- CVE-2017-1000254High
libcurl may read outside of a heap allocated buffer when doing FTP. A flaw in the string parser for the directory name may lead to a missing NUL byte at the end of the buffer, resulting in the potential to read data beyond the allocated memory area.
- CVE-2016-5421High
Use-after-free vulnerability in libcurl before version 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
- CVE-2016-0755High
The ConnectionExists function in lib/url.c in libcurl before version 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request.
- CVE-2025-4947Medium
libcurl accidentally skips certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
- CVE-2024-2398Medium
A vulnerability in the libcurl library causes a memory leak when handling HTTP/2 server push. When an application allows server push and the number of headers exceeds the limit of 1000, libcurl aborts the push but fails to free previously allocated headers.
- CVE-2024-6874Medium
The curl_url_get() function in libcurl offers punycode conversions to and from IDN. When converting a name that is exactly 256 bytes, libcurl reads outside a stack-based buffer when built with the macidn IDN backend.
- CVE-2024-6197High
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.
- CVE-2025-5025Medium
libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, but fails to specify that it does not for QUIC.
Original NVD description (English source)
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.