{"id":"CURL-CVE-2022-32221","summary":"POST following PUT confusion","details":"When doing HTTP(S) transfers, libcurl might erroneously use the read callback\n(`CURLOPT_READFUNCTION`) to ask for data to send, even when the\n`CURLOPT_POSTFIELDS` option has been set, if the same handle previously was\nused to issue a `PUT` request which used that callback.\n\nThis flaw may surprise the application and cause it to misbehave and either\nsend off the wrong data or use memory after free or similar in the subsequent\n`POST` request.\n\nThe problem exists in the logic for a reused handle when it is changed from a\nPUT to a POST.","aliases":["CVE-2022-32221"],"modified":"2025-05-15T17:48:29Z","published":"2022-10-26T08:00:00Z","database_specific":{"issue":"https://hackerone.com/reports/1704017","award":{"currency":"USD","amount":"2400"},"severity":"Medium","affects":"lib","www":"https://curl.se/docs/CVE-2022-32221.html","CWE":{"desc":"Expected Behavior Violation","id":"CWE-440"},"package":"curl","URL":"https://curl.se/docs/CVE-2022-32221.json","last_affected":"7.85.0"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.7"},{"fixed":"7.86.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"546572da0457f37c698c02d0a08d90fdfcbeedec"},{"fixed":"a64e3e59938abd7d667e4470a18072a24d7e9de9"}]}],"versions":["7.85.0","7.84.0","7.83.1","7.83.0","7.82.0","7.81.0","7.80.0","7.79.1","7.79.0","7.78.0","7.77.0","7.76.1","7.76.0","7.75.0","7.74.0","7.73.0","7.72.0","7.71.1","7.71.0","7.70.0","7.69.1","7.69.0","7.68.0","7.67.0","7.66.0","7.65.3","7.65.2","7.65.1","7.65.0","7.64.1","7.64.0","7.63.0","7.62.0","7.61.1","7.61.0","7.60.0","7.59.0","7.58.0","7.57.0","7.56.1","7.56.0","7.55.1","7.55.0","7.54.1","7.54.0","7.53.1","7.53.0","7.52.1","7.52.0","7.51.0","7.50.3","7.50.2","7.50.1","7.50.0","7.49.1","7.49.0","7.48.0","7.47.1","7.47.0","7.46.0","7.45.0","7.44.0","7.43.0","7.42.1","7.42.0","7.41.0","7.40.0","7.39.0","7.38.0","7.37.1","7.37.0","7.36.0","7.35.0","7.34.0","7.33.0","7.32.0","7.31.0","7.30.0","7.29.0","7.28.1","7.28.0","7.27.0","7.26.0","7.25.0","7.24.0","7.23.1","7.23.0","7.22.0","7.21.7","7.21.6","7.21.5","7.21.4","7.21.3","7.21.2","7.21.1","7.21.0","7.20.1","7.20.0","7.19.7","7.19.6","7.19.5","7.19.4","7.19.3","7.19.2","7.19.1","7.19.0","7.18.2","7.18.1","7.18.0","7.17.1","7.17.0","7.16.4","7.16.3","7.16.2","7.16.1","7.16.0","7.15.5","7.15.4","7.15.3","7.15.2","7.15.1","7.15.0","7.14.1","7.14.0","7.13.2","7.13.1","7.13.0","7.12.3","7.12.2","7.12.1","7.12.0","7.11.2","7.11.1","7.11.0","7.10.8","7.10.7","7.10.6","7.10.5","7.10.4","7.10.3","7.10.2","7.10.1","7.10","7.9.8","7.9.7","7.9.6","7.9.5","7.9.4","7.9.3","7.9.2","7.9.1","7.9","7.8.1","7.8","7.7.3","7.7.2","7.7.1","7.7"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","target":{"function":"Curl_vsetopt","file":"lib/setopt.c"},"source":"https://github.com/curl/curl.git/commit/a64e3e59938abd7d667e4470a18072a24d7e9de9","digest":{"length":58084,"function_hash":"22968065415160735040135778472335782425"},"deprecated":false,"id":"CURL-CVE-2022-32221-9751f04c","signature_version":"v1"},{"signature_type":"Line","target":{"file":"lib/setopt.c"},"source":"https://github.com/curl/curl.git/commit/a64e3e59938abd7d667e4470a18072a24d7e9de9","digest":{"line_hashes":["73596727404438881622769716353410783065","150108665408450698810391826671290668314","264542534956227828232279400943172691231","248438938282829223471764231064667949049"],"threshold":0.9},"deprecated":false,"id":"CURL-CVE-2022-32221-b7951194","signature_version":"v1"}],"source":"https://curl.se/docs/CURL-CVE-2022-32221.json"}}],"schema_version":"1.7.3","credits":[{"name":"Robby Simpson","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}