USN-5495-2
curl regression
USN-5495-1 fixed vulnerabilities in curl. The fix for CVE-2022-32205 miscalculated the maximum cookie size, causing a regression. This update fixes the problem.
Original advisory details:
Harry Sintonen discovered that curl incorrectly handled certain cookies. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 21.10, and Ubuntu 22.04 LTS. (CVE-2022-32205)
Harry Sintonen discovered that curl incorrectly handled certain HTTP compressions. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-32206)
Harry Sintonen incorrectly handled certain file permissions. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 21.10, and Ubuntu 22.04 LTS. (CVE-2022-32207)
Harry Sintonen discovered that curl incorrectly handled certain FTP-KRB messages. An attacker could possibly use this to perform a machine-in-the-middle attack. (CVE-2022-32208)
What each source reports
OSVNo score
curl regression
USN-5495-1 fixed vulnerabilities in curl. The fix for CVE-2022-32205 miscalculated the maximum cookie size, causing a regression. This update fixes the problem.
Original advisory details:
Harry Sintonen discovered that curl incorrectly handled certain cookies. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 21.10, and Ubuntu 22.04 LTS. (CVE-2022-32205)
Harry Sintonen discovered that curl incorrectly handled certain HTTP compressions. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-32206)
Harry Sintonen incorrectly handled certain file permissions. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 21.10, and Ubuntu 22.04 LTS. (CVE-2022-32207)
Harry Sintonen discovered that curl incorrectly handled certain FTP-KRB messages. An attacker could possibly use this to perform a machine-in-the-middle attack. (CVE-2022-32208)
- Record
USN-5495-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlUbuntu:22.04:LTS | before 7.81.0-1ubuntu1.21, plus listed versions 7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1 Show 16 moreShow less7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.67.81.0-1ubuntu1.77.81.0-1ubuntu1.87.81.0-1ubuntu1.107.81.0-1ubuntu1.117.81.0-1ubuntu1.137.81.0-1ubuntu1.147.81.0-1ubuntu1.157.81.0-1ubuntu1.167.81.0-1ubuntu1.177.81.0-1ubuntu1.187.81.0-1ubuntu1.197.81.0-1ubuntu1.20 | 7.81.0-1ubuntu1.21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-5495-2 is a vulnerability with no CVSS score yet in curl, published September 29, 2025. No source lists public exploit code. Fixed in curl 7.81.0-1ubuntu1.21.