{"id":"CURL-CVE-2022-27780","summary":"percent-encoded path separator in URL host","details":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'\nwhen decoding the hostname part of a URL, making it a *different* URL using\nthe wrong hostname when it is later retrieved.\n\nFor example, a URL like `http://example.com%2F10.0.0.1/`, would be allowed by\nthe parser and get transposed into `http://example.com/10.0.0.1/`. This flaw\ncan be used to circumvent filters, checks and more.","aliases":["CVE-2022-27780"],"modified":"2026-05-29T05:40:32.070403Z","published":"2022-05-11T08:00:00Z","database_specific":{"www":"https://curl.se/docs/CVE-2022-27780.html","CWE":{"desc":"Improper Handling of URL Encoding","id":"CWE-177"},"issue":"https://hackerone.com/reports/1553841","package":"curl","URL":"https://curl.se/docs/CVE-2022-27780.json","affects":"both","award":{"amount":"2400","currency":"USD"},"last_affected":"7.83.0","severity":"Medium"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"9a8564a920188e49d5bd8c1c8573ddef97f6e03a"},{"fixed":"914aaab9153764ef8fa4178215b8ad89d3ac263a"}]}],"versions":["7.83.0","7.82.0","7.81.0","7.80.0","curl-7_83_0","curl-7_82_0","curl-7_81_0","curl-7_80_0"],"database_specific":{"vanir_signatures_modified":"2026-05-29T05:40:32Z","vanir_signatures":[{"digest":{"function_hash":"175578244964680735291736576270402210988","length":1399},"id":"CURL-CVE-2022-27780-5e408e0f","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/914aaab9153764ef8fa4178215b8ad89d3ac263a","target":{"file":"lib/urlapi.c","function":"hostname_check"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["199957627763592549612385795254149834550","151428187081067779662697927472516771049","119160317506403307842112826299814095034","25289416254833179104566548130852379552"],"threshold":0.9},"id":"CURL-CVE-2022-27780-fb7e3e79","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/914aaab9153764ef8fa4178215b8ad89d3ac263a","target":{"file":"lib/urlapi.c"}}],"source":"https://curl.se/docs/CURL-CVE-2022-27780.json"}}],"schema_version":"1.7.5","credits":[{"name":"Axel Chong","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}