CVE-2022-32206

2022-07-0713:15:08

Google

osv.dev

0.002 Low

EPSS

Percentile

59.1%

JSON

curl < 7.84.0 supports “chained” HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable “links” in this “decompression chain” was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a “malloc bomb”, makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

CPENameOperatorVersion
curleq7.24.0-r0
curleqcurl-7_82_0
curleq7.21.4-r1
curleqcurl-7_40_0
curleq7.46.0-r2
curleqcurl-7_7-beta5
curleqcurl-7_21_7
curleq7.83.0-r0
curleqcurl-7_37_0
curleqcurl-7_10_8

Name	Operator	Version
curl	eq	7.24.0-r0
curl	eq	curl-7_82_0
curl	eq	7.21.4-r1
curl	eq	curl-7_40_0
curl	eq	7.46.0-r2
curl	eq	curl-7_7-beta5
curl	eq	curl-7_21_7
curl	eq	7.83.0-r0
curl	eq	curl-7_37_0
curl	eq	curl-7_10_8