Every CVE Search/ Get API key

CVE-2022-43551

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep...

7.5 HighFix available

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

16.6%Up 15.7 points since Dec 24, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
CVE List 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
EUVDEUVD-2022-46548 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
EUVD-2022-46548
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-25m2-mpq4-29vh 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep...

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
GHSA-25m2-mpq4-29vh
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
OSVALPINE-CVE-2022-43551 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
ALPINE-CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVAZL-12107 7.5

CVE-2022-43551 affecting package curl for versions less than 7.86.0-2

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
AZL-12107
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 20 moreShow less
OSVAZL-12930 7.5

CVE-2022-43551 affecting package cmake for versions less than 3.21.4-3

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
AZL-12930
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-34616 7.5

CVE-2022-43551 affecting package cmake for versions less than 3.21.4-10

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
AZL-34616
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-38788 7.5

CVE-2022-43551 affecting package tensorflow for versions less than 2.16.1-1

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
AZL-38788
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBELL-CVE-2022-43551 7.5

CVE-2022-43551 does not affect BellSoft software

Record
BELL-CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
OSVDEBIAN-CVE-2022-43551 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
DEBIAN-CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVJLSEC-2026-400 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
JLSEC-2026-400
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2023-1007 7.5

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports through an HTTP proxy. HTTP proxies can deny these tunnel operations using an appropriate HTTP error response code. When getting denied to tunnel the specific SMB or TELNET protocols, curl can use a heap-allocated struct after it has been freed and shut down the code path in its transfer.(CVE-2022-43552)

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.(CVE-2022-43551)

Record
OESA-2023-1007
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2023-1834 9.8

mysql security update

The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates

Security Fix(es):

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2022-21509)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.38 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21515)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21517)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21522)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21525)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21526)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are…

Record
OESA-2023-1834
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2023-1835 9.8

mysql security update

The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates

Security Fix(es):

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2022-21509)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.38 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21515)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21517)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21522)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21525)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21526)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are…

Record
OESA-2023-1835
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2023-1836 9.8

mysql security update

The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates

Security Fix(es):

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2022-21509)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.38 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21515)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21517)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21522)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21525)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21526)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are…

Record
OESA-2023-1836
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-2071 9.8

mysql security update

The MySQL(TM) software delivers a very fast, multi-threaded, multi-user, and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates

Security Fix(es):

Security Fix(es):

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.(CVE-2021-22570)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21412)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21413)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21414)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2022-21417)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2022-21418)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

Record
OESA-2024-2071
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3354 9.8

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update

Record
RHSA-2023:3354
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2022-43551 7.5

CVE-2022-43551 in curl - Patched by Root

Root has patched CVE-2022-43551 in the curl package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2022-43551 7.5

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Record
UBUNTU-CVE-2022-43551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCURL-CVE-2022-43551 No score

Another HSTS bypass via IDN

curl's HSTS check could be bypassed to trick it to keep using HTTP.

Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL.

The HSTS mechanism could be bypassed if the hostname in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E). Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Reproducible like this:

curl --hsts hsts.txt https://curl%E3%80%82se
curl --hsts hsts.txt http://curl%E3%80%82se
Record
CURL-CVE-2022-43551
Updated
2026-11-02
OSVMGASA-2022-0483 No score

Updated curl packages fix security vulnerability

Another HSTS bypass via IDN. (CVE-2022-43551) HTTP Proxy deny use-after-free. (CVE-2022-43552)

Record
MGASA-2022-0483
Updated
2026-11-02
OSVopenSUSE-SU-2024:12583-1 No score

curl-7.87.0-1.1 on GA media

These are all security issues fixed in the curl-7.87.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12583-1
Updated
2026-11-02
OSVSUSE-SU-2022:4597-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
  • CVE-2022-43551: Fixed HSTS bypass via IDN (bsc#1206308).
Record
SUSE-SU-2022:4597-1
Updated
2026-11-02
OSVUSN-5788-1 No score

curl vulnerabilities

Hiroki Kurosawa discovered that curl incorrectly handled HSTS support when certain hostnames included IDN characters. A remote attacker could possibly use this issue to cause curl to use unencrypted connections. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-43551)

It was discovered that curl incorrectly handled denials when using HTTP proxies. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-43552)

Record
USN-5788-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.14
 7.77.0 up to 7.79.1-r4
7.79.1-r4
curl
Alpine:v3.15
 7.77.0 up to 7.80.0-r5
7.80.0-r5
curl
Alpine:v3.16
 7.77.0 up to 7.83.1-r5
7.83.1-r5
curl
Alpine:v3.17
 7.77.0 up to 7.87.0-r0
7.87.0-r0
curl
Alpine:v3.18
 7.77.0 up to 7.87.0-r0
7.87.0-r0
curl
Alpine:v3.19
 7.77.0 up to 7.87.0-r0
7.87.0-r0
curl
Alpine:v3.20
 7.77.0 up to 7.87.0-r0
7.87.0-r0
curl
Alpine:v3.21
 7.77.0 up to 7.87.0-r0
7.87.0-r0
curl
Alpine:v3.22
 7.77.0 up to 7.87.0-r0
7.87.0-r0
curl
Alpine:v3.23
 7.77.0 up to 7.87.0-r0
7.87.0-r0
Show 101 moreShow less
Affected packages
PackageAffectedFixed
curl
Alpine:v3.24
 7.77.0 up to 7.87.0-r0
7.87.0-r0
curl
Azure Linux:2
 before 7.86.0-2
7.86.0-2
cmake
Azure Linux:2
 before 3.21.4-3
3.21.4-3
cmake
Azure Linux:3
 before 3.21.4-10
3.21.4-10
tensorflow
Azure Linux:3
 before 2.16.1-1
2.16.1-1
curl
Debian:12
 before 7.86.0-3
7.86.0-3
curl
Debian:13
 before 7.86.0-3
7.86.0-3
curl
Debian:14
 before 7.86.0-3
7.86.0-3
CURL_jll
Julia
 before 8.5.0+0
8.5.0+0
LibCURL_jll
Julia
 7.81.0+0 up to 7.87.0+0
7.87.0+0
curl
Mageia:8
From an advisory covering 2 CVEs
 before 7.74.0-1.10.mga8
7.74.0-1.10.mga8
curl
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 7.79.1-13.oe2203
7.79.1-13.oe2203
mysql
openEuler:22.03-LTS-SP1
From an advisory covering 118 CVEs
 before 8.0.35-1.oe2203sp1
8.0.35-1.oe2203sp1
mysql
openEuler:22.03-LTS-SP2
From an advisory covering 118 CVEs
 before 8.0.35-1.oe2203sp2
8.0.35-1.oe2203sp2
mysql
openEuler:22.03-LTS
From an advisory covering 118 CVEs
 before 8.0.35-1.oe2203
8.0.35-1.oe2203
mysql
openEuler:20.03-LTS-SP4
From an advisory covering 218 CVEs
 before 8.0.38-1.oe2003sp4
8.0.38-1.oe2003sp4
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:2.4.51-39.el7jbcs
1:2.4.51-39.el7jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el7jbcs
0:2.4.51-39.el7jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:2.4.51-39.el7jbcs
1:2.4.51-39.el7jbcs
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-httpd-tools-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-mod_ldap-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:2.4.51-39.el8jbcs
1:2.4.51-39.el8jbcs
jbcs-httpd24-mod_proxy_html-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:2.4.51-39.el8jbcs
1:2.4.51-39.el8jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-mod_session-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:2.4.51-39.el8jbcs
0:2.4.51-39.el8jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:2.4.51-39.el8jbcs
1:2.4.51-39.el8jbcs
jbcs-httpd24-mod_ssl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:2.4.51-39.el8jbcs
1:2.4.51-39.el8jbcs
jbcs-httpd24-openssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el7jbcs
1:1.1.1k-14.el7jbcs
jbcs-httpd24-openssl-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el7jbcs
1:1.1.1k-14.el7jbcs
jbcs-httpd24-openssl-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el7jbcs
1:1.1.1k-14.el7jbcs
jbcs-httpd24-openssl-libs
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el7jbcs
1:1.1.1k-14.el7jbcs
jbcs-httpd24-openssl-perl
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el7jbcs
1:1.1.1k-14.el7jbcs
jbcs-httpd24-openssl-static
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el7jbcs
1:1.1.1k-14.el7jbcs
jbcs-httpd24-openssl
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el8jbcs
1:1.1.1k-14.el8jbcs
jbcs-httpd24-openssl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el8jbcs
1:1.1.1k-14.el8jbcs
jbcs-httpd24-openssl-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el8jbcs
1:1.1.1k-14.el8jbcs
jbcs-httpd24-openssl-libs
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el8jbcs
1:1.1.1k-14.el8jbcs
jbcs-httpd24-openssl-libs-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el8jbcs
1:1.1.1k-14.el8jbcs
jbcs-httpd24-openssl-perl
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el8jbcs
1:1.1.1k-14.el8jbcs
jbcs-httpd24-openssl-static
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 1:1.1.1k-14.el8jbcs
1:1.1.1k-14.el8jbcs
jbcs-httpd24-apr-util
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-ldap
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-mysql
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-nss
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-odbc
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-openssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-pgsql
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util-sqlite
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el7jbcs
0:1.6.1-101.el7jbcs
jbcs-httpd24-apr-util
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-ldap
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-ldap-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-mysql
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-mysql-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-nss
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-nss-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-odbc
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-odbc-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-openssl
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-openssl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-pgsql
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-pgsql-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-sqlite
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-apr-util-sqlite-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:1.6.1-101.el8jbcs
0:1.6.1-101.el8jbcs
jbcs-httpd24-curl
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el7jbcs
0:8.0.1-1.el7jbcs
jbcs-httpd24-curl-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el7jbcs
0:8.0.1-1.el7jbcs
jbcs-httpd24-libcurl
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el7jbcs
0:8.0.1-1.el7jbcs
jbcs-httpd24-libcurl-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el7jbcs
0:8.0.1-1.el7jbcs
jbcs-httpd24-curl
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el8jbcs
0:8.0.1-1.el8jbcs
jbcs-httpd24-curl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el8jbcs
0:8.0.1-1.el8jbcs
jbcs-httpd24-libcurl
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el8jbcs
0:8.0.1-1.el8jbcs
jbcs-httpd24-libcurl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el8jbcs
0:8.0.1-1.el8jbcs
jbcs-httpd24-libcurl-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 14 CVEs
 before 0:8.0.1-1.el8jbcs
0:8.0.1-1.el8jbcs
curl
Root:Debian:11
 before 7.74.0-1.3+deb11u16.root.io.13
7.74.0-1.3+deb11u16.root.io.137.74.0-1.3+deb11u16.aikido.187.74.0-1.3+deb11u16.aikido.197.74.0-1.3+deb11u16.root.io.177.74.0-1.3+deb11u16.root.io.157.74.0-1.3+deb11u16.root.io.167.74.0-1.3+deb11u16.root.io.14
rootio-curl
Root:Debian:11
 before 7.74.0-1.3+deb11u16.root.io.13
7.74.0-1.3+deb11u16.root.io.137.74.0-1.3+deb11u16.aikido.187.74.0-1.3+deb11u16.aikido.197.74.0-1.3+deb11u16.root.io.177.74.0-1.3+deb11u16.root.io.157.74.0-1.3+deb11u16.root.io.167.74.0-1.3+deb11u16.root.io.14
curl
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 7.79.1-150400.5.12.1
7.79.1-150400.5.12.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP4
From an advisory covering 2 CVEs
 before 7.79.1-150400.5.12.1
7.79.1-150400.5.12.1
curl
openSUSE:Leap Micro 5.3
From an advisory covering 2 CVEs
 before 7.79.1-150400.5.12.1
7.79.1-150400.5.12.1
curl
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 7.79.1-150400.5.12.1
7.79.1-150400.5.12.1
curl
Ubuntu:22.04:LTS
 before 7.81.0-1ubuntu1.7, plus listed versions
7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1
Show 4 moreShow less
7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.6
7.81.0-1ubuntu1.7
curl
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 7.58.0-2ubuntu3.22, plus listed versions
7.55.1-1ubuntu27.55.1-1ubuntu2.17.57.0-1ubuntu17.58.0-2ubuntu17.58.0-2ubuntu2
Show 20 moreShow less
7.58.0-2ubuntu37.58.0-2ubuntu3.17.58.0-2ubuntu3.27.58.0-2ubuntu3.37.58.0-2ubuntu3.57.58.0-2ubuntu3.67.58.0-2ubuntu3.77.58.0-2ubuntu3.87.58.0-2ubuntu3.97.58.0-2ubuntu3.107.58.0-2ubuntu3.127.58.0-2ubuntu3.137.58.0-2ubuntu3.147.58.0-2ubuntu3.157.58.0-2ubuntu3.167.58.0-2ubuntu3.177.58.0-2ubuntu3.187.58.0-2ubuntu3.197.58.0-2ubuntu3.207.58.0-2ubuntu3.21
7.58.0-2ubuntu3.22
curl
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.15, plus listed versions
7.65.3-1ubuntu37.65.3-1ubuntu47.66.0-1ubuntu17.67.0-2ubuntu17.68.0-1ubuntu1
Show 12 moreShow less
7.68.0-1ubuntu27.68.0-1ubuntu2.17.68.0-1ubuntu2.27.68.0-1ubuntu2.47.68.0-1ubuntu2.57.68.0-1ubuntu2.67.68.0-1ubuntu2.77.68.0-1ubuntu2.107.68.0-1ubuntu2.117.68.0-1ubuntu2.127.68.0-1ubuntu2.137.68.0-1ubuntu2.14
7.68.0-1ubuntu2.15
curl
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 7.81.0-1ubuntu1.7, plus listed versions
7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1
Show 4 moreShow less
7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.6
7.81.0-1ubuntu1.7
curl
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 7.87.0-1.1
7.87.0-1.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-43551 is a high vulnerability (CVSS 7.5) in Haxx Curl, published December 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.6%, the 97th percentile. Fixed in curl 7.79.1-r4.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 115 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open