#VU62644 Information disclosure in cURL

Published: 2022-04-27

Vulnerability identifier: #VU62644

Vulnerability risk: Low


CVE-ID: CVE-2022-27776


Exploitation vector: Network

Exploit availability:

Vulnerable software:
Client/Desktop applications / Other client software

Vendor: curl.haxx.se


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to curl can leak authentication or cookie header data during HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hosts will make curl send the data to those. However, due to a flawed check, curl wrongly also sends that same set of headers to the hosts that are identical to the first one but use a different port number or URL scheme.

The vulnerability exists due to an incomplete fix for #VU10224 (CVE-2018-1000007).

Install updates from vendor's website.

Vulnerable software versions

cURL: 4.9 - 7.82.0

Fixed software versions


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability