Logo
vulnerabilityCVE-2022-32221
Name
CVE-2022-32221
Source
NVD ( link)Debian ( link)
Description
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Published Date
Updated Date
Workaround
-

Analysis#


Affected Component
Analysis
curl
Patched

Vulnerability Ratings#


9.8
CVSSv31
9.8
CVSSv31
NaN
other

Others affected components#


Name
Project
Project Version
Version
Status
buildroot
2025.02.x
8.20.0
Not Affected
buildroot
master
8.21.0
Not Affected
openwrt
master
8.19.0-r2
Not Affected
openwrt
master
8.20.0-r1
Not Affected
openwrt
openwrt-25.12
8.19.0-r2
Not Affected
openwrt
openwrt-25.12
8.14.1-r1
Not Affected
yocto
master
8.20.0
Not Affected
yocto
scarthgap
8.7.1
Not Affected

Resolved with patches#


curl (yocto:kirkstone)

#
Title
Author
Resolve
1
setopt: when POST is set, reset the 'upload' field
Daniel Stenberg <daniel@haxx.se>
CVE-2022-32221