Description
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.86.0-1 | — |
| Debian 13 | curl | 7.86.0-1 | — |
| Debian 12 | curl | 7.86.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.6 | USN-5702-1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.14 | USN-5702-1 |
| Ubuntu 18.04 LTS | curl | 7.58.0-2ubuntu3.21 | USN-5702-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 7.86.0-2.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.51-37.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_http2 | 1.15.19-20.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.51-37.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1k-13.el7jbcs | RHSA-2022:8840 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.86.0-1.1 | openSUSE-SU-2024:12447-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 7.86.0-r0 | — |
| Alpine v3.23 | curl | 7.86.0-r0 | — |
| Alpine v3.22 | curl | 7.86.0-r0 | — |
| Alpine v3.21 | curl | 7.86.0-r0 | — |
| Alpine v3.20 | curl | 7.86.0-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 7.86.0-r0 | — |
| Alpine v3.18 | curl | 7.86.0-r0 | — |
| Alpine v3.17 | curl | 7.86.0-r0 | — |
| Alpine v3.16 | curl | 7.83.1-r4 | — |
| Alpine v3.15 | curl | 7.80.0-r4 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 7.87.0-2.amzn2023.0.2 | ALAS2023-2023-083 |
| Amazon Linux 2 | curl +2 | 7.79.1-7.amzn2.0.1 | ALAS2-2022-1882 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | tensorflow | 2.16.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 7.86.0-1 | — |
Advisories 21
- RHSA-2022:8840 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- USN-5702-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- WID-SEC-2022-1862 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2026
- openSUSE-SU-2024:12447-1 curl-7.86.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- VDE-2023-001 PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jun 5, 2025
- ICSA-23-131-05 Siemens SINEC NMS Third-Party CISA ICS & IT advisories · May 6, 2025
- WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- ALAS2023-2023-083 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 15, 2024
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
- WID-SEC-2023-0189 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 7, 2023
- WID-SEC-2023-1728 Autodesk AutoCAD: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 11, 2023
- SSA-892048 SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 Siemens ProductCERT · May 9, 2023
- WID-SEC-2023-0296 Meinberg LANTIME: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 6, 2023
- WID-SEC-2022-2372 genua genugate: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 19, 2023
- ALAS2-2022-1882 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 6, 2022
References
- https://curl.se/docs/CVE-2022-42915.html
- FEDORA-2022-01ffde372c vendor-advisory
- FEDORA-2022-39688a779d vendor-advisory
- FEDORA-2022-e9d65906c4 vendor-advisory
- https://security.netapp.com/advisory/ntap-20221209-0010/
- GLSA-202212-01 vendor-advisory
- https://support.apple.com/kb/HT213604
- https://support.apple.com/kb/HT213605
- 20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3 mailing-list
- 20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2 mailing-list