CVE-2021-22901: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session t

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• haxx curl7.75.0 and later · up to 7.76.1 inclusive
• netapp active iq unified managerall versions
• netapp cloud backupall versions
• netapp h300e firmwareall versions
• netapp h300s firmwareall versions
• netapp h410s firmwareall versions
• netapp h500e firmwareall versions
• netapp h500s firmwareall versions
• netapp h700e firmwareall versions
• netapp h700s firmwareall versions
• netapp hci compute node firmwareall versions
• netapp oncommand insightall versions
• netapp oncommand workflow automationall versions
• netapp snapcenterall versions
• netapp solidfire & hci management nodeall versions
• netapp solidfire baseboard management controller firmwareall versions
• netapp solidfire, enterprise sds & hci storage nodeall versions
• oracle communications cloud native core binding support function1.11.0
• oracle communications cloud native core network function cloud native environment1.10.0
• oracle communications cloud native core network repository function1.15.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• n/a https://github.com/curl/curl

  • 7.75.0 through 7.76.1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2023-38039When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.
  47Plan
• CVE-2024-2398HTTP/2 push headers memory-leak
  45Plan
• CVE-2019-5482Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
  44Plan

Published before and after this one in the same product

• ← EarlierCVE-2021-22897Jun 11, 2021 · curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST w
  22Monitor
• ← EarlierCVE-2021-22898Jun 11, 2021 · curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcur
  13Monitor
• Later →CVE-2021-22922Aug 5, 2021 · When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML
  27Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.