Description
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.86.0-1 | — |
| Debian 13 | curl | 7.86.0-1 | — |
| Debian 12 | curl | 7.86.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.6 | USN-5702-1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.14 | USN-5702-1 |
| Ubuntu 18.04 LTS | curl | 7.58.0-2ubuntu3.21 | USN-5702-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 7.86.0-2.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.51-37.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_http2 | 1.15.19-20.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.51-37.el7jbcs | RHSA-2022:8840 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1k-13.el7jbcs | RHSA-2022:8840 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | curl | 7.79.1-150400.5.9.1 | SUSE-SU-2022:3785-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.3 | curl | 7.79.1-150400.5.9.1 | SUSE-SU-2022:3785-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.86.0-1.1 | openSUSE-SU-2024:12447-1 |
| openSUSE Leap 15.4 | curl | 7.79.1-150400.5.9.1 | SUSE-SU-2022:3785-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 7.86.0-r0 | — |
| Alpine v3.23 | curl | 7.86.0-r0 | — |
| Alpine v3.22 | curl | 7.86.0-r0 | — |
| Alpine v3.21 | curl | 7.86.0-r0 | — |
| Alpine v3.20 | curl | 7.86.0-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 7.86.0-r0 | — |
| Alpine v3.18 | curl | 7.86.0-r0 | — |
| Alpine v3.17 | curl | 7.86.0-r0 | — |
| Alpine v3.16 | curl | 7.83.1-r4 | — |
| Alpine v3.15 | curl | 7.80.0-r4 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 7.87.0-2.amzn2023.0.2 | ALAS2023-2023-083 |
| Amazon Linux 2 | curl +2 | 7.79.1-7.amzn2.0.1 | ALAS2-2022-1882 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | tensorflow | 2.16.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 7.86.0-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | curl | 7.86.0-r0 | — |
Advisories 23
- RHSA-2022:8840 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2023-2031 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- USN-5702-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- WID-SEC-2022-1862 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2026
- openSUSE-SU-2024:12447-1 curl-7.86.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3785-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- VDE-2023-001 PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jun 5, 2025
- ICSA-23-131-05 Siemens SINEC NMS Third-Party CISA ICS & IT advisories · May 6, 2025
- ALAS2023-2023-083 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 15, 2024
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
- WID-SEC-2023-0189 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 7, 2023
- WID-SEC-2023-1728 Autodesk AutoCAD: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 11, 2023
- SSA-892048 SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 Siemens ProductCERT · May 9, 2023
- WID-SEC-2023-1026 Oracle Virtualization: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-0296 Meinberg LANTIME: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 6, 2023
- WID-SEC-2022-2372 genua genugate: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 19, 2023
- ALAS2-2022-1882 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 6, 2022
References
- https://curl.se/docs/CVE-2022-42916.html
- FEDORA-2022-01ffde372c vendor-advisory
- FEDORA-2022-39688a779d vendor-advisory
- FEDORA-2022-e9d65906c4 vendor-advisory
- https://security.netapp.com/advisory/ntap-20221209-0010/
- GLSA-202212-01 vendor-advisory
- [oss-security] 20221221 curl: CVE-2022-43551: Another HSTS bypass via IDN mailing-list
- https://support.apple.com/kb/HT213604
- https://support.apple.com/kb/HT213605
- 20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3 mailing-list
- 20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2 mailing-list