An update of the curl package has been released.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5412-1 advisory.

    Axel Chong discovered that curl incorrectly handled percent-encoded URL separators. A remote attacker     could possibly use this issue to trick curl into using the wrong URL and bypass certain checks or filters.
    This issue only affected Ubuntu 22.04 LTS. (CVE-2022-27780)

    Florian Kohnhuser discovered that curl incorrectly handled returning a TLS server's certificate chain     details. A remote attacker could possibly use this issue to cause curl to stop responding, resulting in a     denial of service. (CVE-2022-27781)

    Harry Sintonen discovered that curl incorrectly reused a previous connection when certain options had been     changed, contrary to expectations. (CVE-2022-27782)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d15a736748 advisory.

    - fix too eager reuse of TLS and SSH connections (CVE-2022-27782)
    - do not accept cookies for TLD with trailing dot (CVE-2022-27779)
    - hsts: ignore trailing dots when comparing hosts names (CVE-2022-30115)
    - reject percent-encoded path separator in URL host (CVE-2022-27780)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-083 advisory.

    2024-02-15: CVE-2022-27781 was added to this advisory.

    A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections     without properly ensuring that the connection was authenticated with the same credentials set for this     transfer. This issue leads to an authentication bypass, either by mistake or by a malicious actor.
    (CVE-2022-22576)

    A vulnerability was found in curl. This security flaw allows leaking credentials to other servers when it     follows redirects from auth-protected HTTP(S) URLs to other protocols and port numbers. (CVE-2022-27774)

    A vulnerability was found in curl. This security flaw occurs due to errors in the logic where the config     matching function did not take the IPv6 address zone id into account. This issue can lead to curl reusing     the wrong connection when one transfer uses a zone id, and the subsequent transfer uses another.
    (CVE-2022-27775)

    A vulnerability was found in curl. This security flaw allows leak authentication or cookie header data on     HTTP redirects to the same host but another port number. Sending the same set of headers to a server on a     different port number is a problem for applications that pass on custom `Authorization:` or     `Cookie:`headers. Those headers often contain privacy-sensitive information or data. (CVE-2022-27776)

    A vulnerability was found in curl. The issue occurs because curl wrongly allows HTTP cookies to be set for     Top Level Domains (TLDs) if the hostname is provided with a trailing dot. This flaw allows arbitrary sites     to set cookies that get sent to a different and unrelated site or domain by a malicious actor.
    (CVE-2022-27779)

    A vulnerability was found in curl. This issue occurs because the curl URL parser wrongly accepts percent-     encoded URL separators like / when decoding the hostname part of a URL, making it a different URL using     the wrong hostname when it is later retrieved. This flaw allows a malicious actor to make circumventing     filters. (CVE-2022-27780)

    libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

    A vulnerability was found in curl. This issue occurs because curl can reuse a previously created     connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw     leads to an authentication bypass, either by mistake or by a malicious actor. (CVE-2022-27782)

    A vulnerability was found in curl. This issue occurs because when using its HTTP Strict Transport     Security(HSTS) support, it can instruct curl to use HTTPS directly instead of using an insecure clear text     HTTP step even when HTTP is provided in the URL. This flaw leads to a clear text transmission of sensitive     information. (CVE-2022-30115)

    A vulnerability was found in curl. This issue occurs because a malicious server can serve excessive     amounts of `Set-Cookie:` headers in an HTTP response to curl, which stores all of them. This flaw leads to     a denial of service, either by mistake or by a malicious actor. (CVE-2022-32205)

    A vulnerability was found in curl. This issue occurs because the number of acceptable links in the     decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited number of     compression steps. This flaw leads to a denial of service, either by mistake or by a malicious actor.
    (CVE-2022-32206)

    A vulnerability was found in curl. This issue occurs because when curl saves cookies, alt-svc, and HSTS     data to local files, it makes the operation atomic by finalizing the process with a rename from a     temporary name to the final target file name. This flaw leads to unpreserved file permissions, either by     mistake or by a malicious actor. (CVE-2022-32207)

    A vulnerability was found in curl. This issue occurs because it mishandles message verification failures     when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack     to go unnoticed and allows data injection into the client. (CVE-2022-32208)

    A vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might     erroneously use the read callback () to ask for data to send, even when the  option has been set if it     previously used the same handle to issue a  request which used that callback. This flaw may surprise the     application and cause it to misbehave and either send off the wrong data or use memory after free or     similar in the subsequent  request. (CVE-2022-32221)

    A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies     from an HTTP(S) server, where it accepts cookies using control codes (byte values below 32), and also when     cookies that contain such control codes are later sent back to an HTTP(S) server, possibly causing the     server to return a 400 response. This issue effectively allows a sister site to deny service to siblings     and cause a denial of service attack. (CVE-2022-35252)

    A vulnerability was found in curl. The issue occurs when curl is told to parse a `.netrc` file for     credentials. If that file ends in a line with consecutive non-white space letters and no newline, curl     could read past the end of the stack-based buffer, and if the read works, it can write a zero byte beyond     its boundary. This issue, in most cases, causes a segfault or similar problem. A denial of service can     occur if a malicious user can provide a custom netrc file to an application or otherwise affect its     contents. (CVE-2022-35260)

    A vulnerability was found in curl. The issue occurs if curl is told to use an HTTP proxy for a transfer     with a non-HTTP(S) URL. It sets up the connection to the remote server by issuing a `CONNECT` request to     the proxy and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP     proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead     return a non-200 response code to the client. Due to flaws in the error/cleanup handling, this could     trigger a double-free issue in curl if using one of the following schemes in the URL for the transfer:
    `dict,` `gopher,` `gophers,` `ldap`, `ldaps`, `rtmp`, `rtmps`, `telnet.` (CVE-2022-42915)

    A vulnerability was found in curl. The issue occurs because curl's HSTS check can be bypassed to trick it     to keep using HTTP. Using its HSTS support, it can instruct curl to use HTTPS directly instead of using an     insecure clear-text HTTP step even when HTTP is provided in the URL. This mechanism can be bypassed if the     hostname in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN     conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full     stop (U+002E) . (CVE-2022-42916)

    A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.
    Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP     step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name     in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN     conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full     stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text     transfer. Because it would store the info IDN encoded but look for it IDN decoded. (CVE-2022-43551)

    A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it     supports through an HTTP proxy. HTTP proxies can deny these tunnel operations using an appropriate HTTP     error response code. When getting denied to tunnel the specific SMB or TELNET protocols, curl can use a     heap-allocated struct after it has been freed and shut down the code path in its transfer.
    (CVE-2022-43552)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1401 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.6. It addresses 148 CVEs:
    CVE-2023-32001, CVE-2022-27775, CVE-2018-1000005, CVE-2022-27774, CVE-2022-32221, and 143 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.83.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-131-01 advisory.

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

  - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-     clobber` is used together with `--remove-on-error`. (CVE-2022-27778)

  - libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a     trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or     without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more     rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if     thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would     get sent to adifferent and unrelated site or domain. (CVE-2022-27779)

  - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name     part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For     example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed     into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
    (CVE-2022-27780)

  - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 11e36890-d28c-11ec-a06f-d4c9ef517024 advisory.

  - Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-     text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in     the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around
    - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
    (CVE-2022-30115)

  - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-     clobber` is used together with `--remove-on-error`. (CVE-2022-27778)

  - libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a     trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or     without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more     rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if     thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would     get sent to adifferent and unrelated site or domain. (CVE-2022-27779)

  - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name     part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For     example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed     into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
    (CVE-2022-27780)

  - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
203221	Photon OS 4.0: Curl PHSA-2022-4.0-0205	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/29	high
161058	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : curl vulnerabilities (USN-5412-1)	Nessus	Ubuntu Local Security Checks	2022/5/11	2025/9/3	high
161149	Fedora 36 : curl (2022-d15a736748)	Nessus	Fedora Local Security Checks	2022/5/12	2024/11/14	high
203950	Photon OS 3.0: Curl PHSA-2022-3.0-0406	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/29	high
173171	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-083)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	critical
353701	Rocky Linux 9.6 [CIQ] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ciqsa-2026_1401)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
161057	Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2022-131-01)	Nessus	Slackware Local Security Checks	2022/5/11	2023/10/27	high
161169	FreeBSD : curl -- Multiple vulnerabilities (11e36890-d28c-11ec-a06f-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	2022/5/13	2023/10/27	high

検出

プラグインの検索

high

high

high

high

critical

critical

critical

critical

high

high