CVE-2022-27775
published 2022-06-02CVE-2022-27775: An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
3.15%
87.4th percentile
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.83.0-1 (bookworm) | curl 7.83.0-1 (bookworm) |
| debian | debian_linux | — | — |
| haxx | curl | >= 0 < 7.74.0-1.3+deb11u2 | 7.74.0-1.3+deb11u2 |
| haxx | curl | >= 0 < 7.83.0-1 | 7.83.0-1 |
| haxx | curl | >= 0 < 7.83.0-1 | 7.83.0-1 |
| haxx | curl | >= 0 < 7.83.0-1 | 7.83.0-1 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.17 | 7.58.0-2ubuntu3.17 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.10 | 7.68.0-1ubuntu2.10 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.1 | 7.81.0-1ubuntu1.1 |
| haxx | curl | 7.65.0 – 7.82.0 | — |
| https | github.com_curl_curl | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | cm1_curl_7.76.0-9_on_cbl_mariner_1.0 | — | — |
| splunk | universal_forwarder | — | — |
| splunk | universal_forwarder | >= 8.2.0 < 8.2.12 | 8.2.12 |
| splunk | universal_forwarder | >= 9.0.0 < 9.0.6 | 9.0.6 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv8.1HIGH
vendor_ubuntu8.1HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fx56-rj7x-688m: An information disclosure vulnerability exists in curl 7
ghsa_unreviewed·2022-06-03
CVE-2022-27775 [HIGH] CWE-200 GHSA-fx56-rj7x-688m: An information disclosure vulnerability exists in curl 7
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
OSV
CVE-2022-27775: An information disclosure vulnerability exists in curl 7
osv·2022-06-02·CVSS 7.5
CVE-2022-27775 [HIGH] CVE-2022-27775: An information disclosure vulnerability exists in curl 7
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
OSV
curl vulnerabilities
osv·2022-04-28·CVSS 8.1
CVE-2022-22576 [HIGH] curl vulnerabilities
curl vulnerabilities
Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2.
An attacker could possibly use this issue to access sensitive information.
(CVE-2022-22576)
Harry Sintonen discovered that curl incorrectly handled certain requests.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2022-27774, CVE-2022-27775, CVE-2022-27776)
Microsoft
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a conne
vendor_msrc·2022-06-14·CVSS 7.5
CVE-2022-27775 [HIGH] CWE-200 An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a conne
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we w
Ubuntu
curl vulnerabilities
vendor_ubuntu·2022-04-28·CVSS 8.1
CVE-2022-27774 [HIGH] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2.
An attacker could possibly use this issue to access sensitive information.
(CVE-2022-22576)
Harry Sintonen discovered that curl incorrectly handled certain requests.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2022-27774, CVE-2022-27775, CVE-2022-27776)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: bad local IPv6 connection reuse
vendor_redhat·2022-04-27·CVSS 7.5
CVE-2022-27775 [HIGH] CWE-200 curl: bad local IPv6 connection reuse
curl: bad local IPv6 connection reuse
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
A vulnerability was found in curl. This security flaw occurs due to errors in the logic where the config matching function did not take the IPv6 address zone id into account. This issue can lead to curl reusing the wrong connection when one transfer uses a zone id, and the subsequent transfer uses another.
Statement: This flaw does not affect the dotnet product because the version shipped is outside of the affected range.
Package: rh-dotnet31-curl (.NET Core 3.1 on Red Hat Enterprise Linux) - Not affected
Package: curl (Red Hat Enterpri
Debian
CVE-2022-27775: curl - An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vuln...
vendor_debian·2022·CVSS 7.5
CVE-2022-27775 [HIGH] CVE-2022-27775: curl - An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vuln...
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
Scope: local
bookworm: resolved (fixed in 7.83.0-1)
bullseye: resolved (fixed in 7.74.0-1.3+deb11u2)
forky: resolved (fixed in 7.83.0-1)
sid: resolved (fixed in 7.83.0-1)
trixie: resolved (fixed in 7.83.0-1)
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2022-27775: Bad local IPv6 connection reuse
hackerone·2022-04-29·CVSS 7.5
CVE-2022-27775 [HIGH] CVE-2022-27775: Bad local IPv6 connection reuse
CVE-2022-27775: Bad local IPv6 connection reuse
## Summary:
curl/libcurl doesn't consider IPv6 address zone index when doing connection reuse. if connection exists to specific IPv6 address (and other conditions for connection reuse are fulfilled) it will be reused for connections regardless of the zone index.
## Steps To Reproduce:
1. Set up a fake server: `echo -ne 'HTTP/1.1 200 OK\r\nContent-Length: 6\r\n\r\nHello\n' | nc -6 -v -l -p 9999`
2. curl "http://[ipv6addr]:9999/x" "http://[ipv6addr%25lo]:9999/y"
Both connections arrive to the test server:
```
Listening on :: 9999
Connection received on somehost someport
GET /x HTTP/1.1
Host: [ipv6addr]:9999
User-Agent: curl/7.83.0-DEV
Accept: */*
GET /y HTTP/1.1
Host: [ipv6addr]:9999
User-Agent: curl/7.83.0-DEV
Accept: */*
```
Clearly th
HackerOne
CVE-2022-27775: Bad local IPv6 connection reuse
hackerone·2022-04-27·CVSS 7.5
CVE-2022-27775 [HIGH] CVE-2022-27775: Bad local IPv6 connection reuse
CVE-2022-27775: Bad local IPv6 connection reuse
## Summary:
Curl doesn't consider IPv6 address zone index when doing connection reuse. if connection exists to specific IPv6 address (and other conditions for connection reuse are fulfilled) it will be reused for connections regardless of the zone index.
## Steps To Reproduce:
1.Set up a fake server: `echo -ne 'HTTP/1.1 200 OK\r\nContent-Length: 6\r\n\r\nHello\n' | nc -6 -v -l -p 9999`
2. curl "http://[ipv6addr]:9999/x" "http://[ipv6addr%25lo]:9999/y"
Both connections arrive to the test server:
```
Listening on :: 9999
Connection received on somehost someport
GET /x HTTP/1.1
Host: [ipv6addr]:9999
User-Agent: curl/7.83.0-DEV
Accept: */*
GET /y HTTP/1.1
Host: [ipv6addr]:9999
User-Agent: curl/7.83.0-DEV
Accept: */*
```
Clearly the 2nd con
Bugzilla
CVE-2022-27775 curl: bad local IPv6 connection reuse
bugzilla·2022-04-25·CVSS 7.5
CVE-2022-27775 [HIGH] CVE-2022-27775 curl: bad local IPv6 connection reuse
CVE-2022-27775 curl: bad local IPv6 connection reuse
Due to errors in the logic, the config matching function did not take the IPv6 address zone id into account which could lead to libcurl reusing wrong
connection when one transfer uses a zone id and subsequent transfer uses another.
Discussion:
https://curl.se/docs/CVE-2022-27775.html
---
Created curl tracking bugs for this issue:
Affects: fedora-all [bug 2079171]
Created mingw-curl tracking bugs for this issue:
Affects: fedora-all [bug 2079172]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2022:8299 https://access.redhat.com/errata/RHSA-2022:8299
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat
https://hackerone.com/reports/1546268https://security.gentoo.org/glsa/202212-01https://security.netapp.com/advisory/ntap-20220609-0008/https://www.debian.org/security/2022/dsa-5197https://hackerone.com/reports/1546268https://security.gentoo.org/glsa/202212-01https://security.netapp.com/advisory/ntap-20220609-0008/https://www.debian.org/security/2022/dsa-5197https://hackerone.com/reports/1546268
2022-06-02
Published