Skip to content
OpenAdvisories
High · 7.5 CVE-2022-43551 EUVD-2022-46548GHSA-25m2-mpq4-29vh

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can b…

Published Dec 23, 2022 · Updated Oct 14, 2026 · Assigned by hackerone

Package: cmake Package: curl Package: curl Package: curl Package: curl Package: curl Package: tensorflow Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Affected products

VendorProductAffectedFixed
— https://github.com/curl/curl Fixed in curl 7.87.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 curl 7.86.0-3 —
Debian 13 curl 7.86.0-3 —
Debian 12 curl 7.86.0-3 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS curl 7.81.0-1ubuntu1.7 USN-5788-1
Ubuntu 20.04 LTS curl 7.68.0-1ubuntu2.15 USN-5788-1
Ubuntu 18.04 LTS curl 7.58.0-2ubuntu3.22 USN-5788-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss Core Services 1 jbcs-httpd24-apr-util +8 1.6.1-101.el7jbcs RHSA-2023:3354
Red Hat JBoss Core Services 1 jbcs-httpd24-curl +2 8.0.1-1.el7jbcs RHSA-2023:3354
Red Hat JBoss Core Services 1 jbcs-httpd24-httpd +6 2.4.51-39.el7jbcs RHSA-2023:3354
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_ssl +1 1:2.4.51-39.el7jbcs RHSA-2023:3354
Red Hat JBoss Core Services 1 jbcs-httpd24-openssl +4 1:1.1.1k-14.el7jbcs RHSA-2023:3354

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 curl 7.79.1-150400.5.12.1 SUSE-SU-2022:4597-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 5.3 curl 7.79.1-150400.5.12.1 SUSE-SU-2022:4597-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed curl 7.87.0-1.1 openSUSE-SU-2024:12583-1
openSUSE Leap 15.4 curl 7.79.1-150400.5.12.1 SUSE-SU-2022:4597-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.3 curl 7.79.1-150400.5.12.1 SUSE-SU-2022:4597-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 curl 7.87.0-r0 —
Alpine v3.23 curl 7.87.0-r0 —
Alpine v3.22 curl 7.87.0-r0 —
Alpine v3.21 curl 7.87.0-r0 —
Alpine v3.20 curl 7.87.0-r0 —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 curl 7.87.0-r0 —
Alpine v3.18 curl 7.87.0-r0 —
Alpine v3.17 curl 7.87.0-r0 —
Alpine v3.16 curl 7.83.1-r5 —
Alpine v3.15 curl 7.80.0-r5 —
Alpine v3.14 curl 7.79.1-r4 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 curl +4 7.87.0-2.amzn2023.0.2 ALAS2023-2023-083
Amazon Linux 2 curl +2 7.87.0-2.amzn2.0.1 ALAS2-2023-1924

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cmake 3.21.4-10 —
Azure Linux 3 tensorflow 2.16.1-1 —
Azure Linux 2 (CBL-Mariner) cmake 3.21.4-3 —
Azure Linux 2 (CBL-Mariner) curl 7.86.0-2 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling curl 7.87.0-r0 —

Advisories 19

References