CVE-2021-22946 @ Library
Status
new
Priority
2.25
Match score
4.0
Risk
InfoLeak
Remote
priv:user
CVSS
7.5 HIGH
Reason
cpe: curl; pkgs: curl; version: in-range: curl-7.52.1-5+deb9u16; risk:info_disclosure
Created
2026-10-15T10:20:39Z
Updated
2026-10-20T10:18:47Z
Package interrogation (copy)
Run on the host — click to copy a command. Debian/apt
| Package | Commands |
|---|---|
| curl-7.52.1-5+deb9u16 | |
| libcurl3-7.52.1-5+deb9u16 | |
| libcurl3-gnutls-7.52.1-5+deb9u16 | |
| php7.0-curl-7.0.33-0+deb9u12 |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: curl
| System | Matches | Ticket for CVE-2021-22946 | |
|---|---|---|---|
| Archive | curl 7.64.0-4+deb10u9; libcurl4 7.64.0-4+deb10u9 | new open | |
| Janus | curl 7.64.0-4+deb10u9; libcurl3-gnutls 7.64.0-4+deb10u9; libcurl4 7.64.0-4+deb10u9 | new open | |
| Library | curl 7.52.1-5+deb9u16; libcurl3 7.52.1-5+deb9u16; libcurl3-gnutls 7.52.1-5+deb9u16; php7.0-curl 7.0.33-0+deb9u12 | new open | |
| Saiph | curl 7.64.0-4+deb10u9; libcurl3-gnutls 7.64.0-4+deb10u9; libcurl4 7.64.0-4+deb10u9 | new open | |
| morris | alt-curl 7.64.0; alt-curlssl 7.62.0; alt-curlssl11 8.22.0; alt-libcurl 7.64.0; alt-libcurlssl 7.62.0; alt-libcurlssl11 8.22.0; cpanel-perl-536-net-curl 0.50; cpanel-perl-536-net-curl-promiser 0.18 (+13 more) | new open | |
| mufasa | alt-curl 7.64.0; alt-curlssl11 8.22.0; alt-libcurl 7.64.0; alt-libcurlssl 7.62.0; alt-libcurlssl11 8.22.0; cpanel-perl-536-net-curl 0.50; cpanel-perl-536-net-curl-promiser 0.18; curl 7.29.0 (+5 more) | new open | |
| Bullseye | libcurl3-gnutls 7.74.0-1.3+deb11u16; libcurl4 7.74.0-1.3+deb11u16; python3-pycurl 7.43.0.6-5 | none | |
| Helios | curl 7.74.0-1.3+deb11u16; libcurl3-gnutls 7.74.0-1.3+deb11u16; libcurl4 7.74.0-1.3+deb11u16 | none | |
| Matrix | curl 7.88.1-10+deb12u15; libcurl3-gnutls 7.88.1-10+deb12u15; libcurl4 7.88.1-10+deb12u15; python3-pycurl 7.45.2-3 | none | |
| Silk | alt-curlssl 8.22.0-2; alt-libcurlssl 8.22.0-2; curl 7.88.1-10+deb12u15; libcurl3-gnutls 7.88.1-10+deb12u15; libcurl4 7.88.1-10+deb12u15; php8.2-curl 8.2.34-1~deb12u1; python3-pycurl 7.45.2-3 | none |
Same product CVEs in your queue
Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.
| CVE | CVSS | KEV | Systems | Status | Matched | Already related | |
|---|---|---|---|---|---|---|---|
| CVE-2022-32221 | 9.8 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2023-27534 | 8.8 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2023-27533 | 8.8 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2024-2398 | 8.6 | Archive, Janus, Library, Saiph | new | curl | — | ||
| CVE-2022-27782 | 7.5 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2022-27781 | 7.5 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2021-22926 | 7.5 | Archive, Helios, Janus, Library, Saiph | new | curl | — | ||
| CVE-2025-0725 | 7.3 | Archive, Helios, Janus, Library, Matrix … | new | curl | — |
Related CVE (same fix)
Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.
Host OS / kernel
OS
Debian GNU/Linux 9 (stretch)
(9)
· debian
Arch
x86_64
kernel_release
uname -r → 4.9.0-19-amd64kernel_version
uname -v → #1 SMP Debian 4.9.320-2 (2022-06-30)For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Same CVE on other hosts
Open the ticket for this CVE on another system.
| System | Status | Priority | Updated | |
|---|---|---|---|---|
| morris | new | 7.5 | 2026-10-20T10:18:47Z | Open |
| mufasa | new | 7.5 | 2026-10-20T10:18:47Z | Open |
| Archive | new | 1.12 | 2026-10-20T10:18:47Z | Open |
| Janus | new | 1.12 | 2026-10-20T10:18:47Z | Open |
| Saiph | new | 1.12 | 2026-10-20T10:18:47Z | Open |
Description
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
Update status
Add note only
References
- http://seclists.org/fulldisclosure/2022/Mar/29
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1334111
- https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20211029-0003/
- https://security.netapp.com/advisory/ntap-20220121-0008/
- https://support.apple.com/kb/HT213183
- https://www.debian.org/security/2022/dsa-5197
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
NVD: CVE-2021-22946