CVE-2021-22897
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a...
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
CVE-2021-22897- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-840, CWE-668
- Updated
- 2026-11-02
CVE List
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
CVE-2021-22897- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-840
- Updated
- 2026-11-02
EUVDEUVD-2021-10029
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
EUVD-2021-10029- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-frcg-47mh-pj2g
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a...
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
GHSA-frcg-47mh-pj2g- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-22897
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
ALPINE-CVE-2021-22897- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVAZL-6358
CVE-2021-22897 affecting package curl for versions less than 7.76.0-5
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
AZL-6358- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVBELL-CVE-2021-22897
CVE-2021-22897 does not affect BellSoft software
- Record
BELL-CVE-2021-22897- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSV
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
CVE-2021-22897- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-1333
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
JLSEC-2026-1333- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2021-1216
curl security update
cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
Security Fix(es):
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.(CVE-2021-22897)
curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.(CVE-2021-22898)
- Record
OESA-2021-1216- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCURL-CVE-2021-22897 No score
Schannel cipher selection surprise
libcurl lets applications specify which specific TLS ciphers to use in
transfers, using the option called CURLOPT_SSL_CIPHER_LIST. The cipher
selection is used for the TLS negotiation when a transfer is done involving
any of the TLS based transfer protocols libcurl supports, such as HTTPS, FTPS,
IMAPS, POP3S, SMTPS etc.
Due to a mistake in the code, the selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers accidentally controls the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Record
CURL-CVE-2021-22897- Updated
- 2026-11-02
Affected products
- haxx curl
- netapp cloud backup
- netapp h300e firmware
- netapp h300s firmware
- netapp h410s firmware
- netapp h500e firmware
- netapp h500s firmware
- netapp h700e firmware
- netapp h700s firmware
- netapp hci compute node firmware
- netapp solidfire\, enterprise sds \& hci storage node
- netapp solidfire \& hci management node
Show 13 moreShow less
- netapp solidfire baseboard management controller firmware
- oracle communications cloud native core binding support function
- oracle communications cloud native core network function cloud native environment
- oracle communications cloud native core network repository function
- oracle communications cloud native core network slice selection function
- oracle communications cloud native core service communication proxy
- oracle essbase
- oracle mysql server
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp
- siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp
- siemens sinec infrastructure network services
- siemens siplus s7-1500 cpu 1518-4 pn/dp mfp
- splunk universal forwarder
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAzure Linux:2 |
before 7.76.0-5 | 7.76.0-5 |
LibCURL_jllJulia |
before 7.81.0+0 | 7.81.0+0 |
curlopenEuler:20.03-LTS-SP1 |
before 7.71.1-7.oe1 | 7.71.1-7.oe1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22897 is a medium vulnerability (CVSS 5.3) in Haxx Curl, published May 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.26%, the 91st percentile. Fixed in curl 7.76.0-5.
References
hackerone.com/reports/1172857
curl.se/docs/CVE-2021-22897.html
github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511
oracle.com//security-alerts/cpujul2021.html
security.netapp.com/advisory/ntap-20210727-0007
Show 10 moreShow less
cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
nvd.nist.gov/vuln/detail/CVE-2021-22897
security.alpinelinux.org/vuln/CVE-2021-22897
docs.bell-sw.com/security/cves/CVE-2021-22897
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1216