{"id":"CVE-2021-22876","aliases":["ALPINE-CVE-2021-22876","ALSA-2021:4511","BELL-CVE-2021-22876","CLSA-2021-1617285762","CLSA-2021-1634922432","CLSA-2022-1643198583","CLSA-2026-1773161124","CURL-CVE-2021-22876","DEBIAN-CVE-2021-22876","DLA-2664-1","DSA-4881-1","EUVD-2021-10011","GHSA-jjr6-2g8j-hmwr","JLSEC-2025-26","MGASA-2021-0186","OESA-2021-1170","RHSA-2021:2472","RHSA-2021:4511","RHSA-2022:1354","RLSA-2021:4511","SUSE-SU-2021:1006-1","SUSE-SU-2021:1396-1","SUSE-SU-2021:14707-1","SUSE-SU-2021:1786-1","SUSE-SU-2021:1809-1","UBUNTU-CVE-2021-22876","USN-4898-1","USN-4903-1","openSUSE-SU-2021:0510-1","openSUSE-SU-2024:10582-1"],"status":"published","title":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information...","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.05301,"percentile":0.92697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-359"],"published":"2021-03-30T00:00:00Z","modified":"2026-10-29T11:01:42Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.76.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"curl","fixed_in":["7.19.7-56.el6.cloudlinux.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libcurl","fixed_in":["7.19.7-56.el6.cloudlinux.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","fixed_in":["7.19.7-56.el6.cloudlinux.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"curl","fixed_in":["7.19.7-56.el6.cloudlinux.ol.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","fixed_in":["7.19.7-56.el6.cloudlinux.ol.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","fixed_in":["7.19.7-56.el6.cloudlinux.ol.els6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.74.0-1.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.74.0-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.74.0-1.2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"curl","fixed_in":["7.52.1-5+deb9u14"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.81.0+0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","fixed_in":["7.60.0-11.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","fixed_in":["7.60.0-11.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","fixed_in":["7.60.0-11.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","fixed_in":["7.37.0-70.60.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-56.el6.cloudlinux.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-56.el6.cloudlinux.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-56.el6.cloudlinux.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-56.el6.cloudlinux.ol.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-56.el6.cloudlinux.ol.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-56.el6.cloudlinux.ol.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-5+deb9u14"}]}],"versions":["7.52.1-5","7.52.1-5+deb9u1","7.52.1-5+deb9u10","7.52.1-5+deb9u11","7.52.1-5+deb9u12","7.52.1-5+deb9u13","7.52.1-5+deb9u2","7.52.1-5+deb9u3","7.52.1-5+deb9u4","7.52.1-5+deb9u5","7.52.1-5+deb9u6","7.52.1-5+deb9u7","7.52.1-5+deb9u8","7.52.1-5+deb9u9"]},{"source":"osv","ecosystem":"Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u2"}]}],"versions":["7.64.0-4","7.64.0-4+deb10u1"],"bundled":8},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.81.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.0-1.2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-6.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-18.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-105.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-105.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-105.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-55.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-jansson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-55.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-jansson-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-55.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.16-5.Final_redhat_2.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.16-5.Final_redhat_2.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-17.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-17.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-36.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-36.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-63.GA.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-63.GA.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-74.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-18.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-18.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-105.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-105.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-105.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-util-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-82.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-40.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-brotli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-40.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-40.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-55.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-jansson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-55.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-jansson-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-55.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.77.0-2.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.16-5.Final_redhat_2.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.16-5.Final_redhat_2.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-17.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-17.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-16.redhat_1.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-36.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-36.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-63.GA.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-63.GA.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-74.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-37.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-37.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-37.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-6.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-chil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-chil-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-6.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-6.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-6.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-6.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-6.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-pkcs11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-20.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-pkcs11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-20.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-6.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-18.el8jbcs"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm7"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.13"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.5"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.13"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.5"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm7"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1.1"}]}],"bundled":48}],"products":[{"vendor":"broadcom","product":"fabric_operating_system"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"libcurl"},{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"hci_storage_node"},{"vendor":"netapp","product":"solidfire"},{"vendor":"oracle","product":"communications_billing_and_revenue_management"},{"vendor":"oracle","product":"essbase"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1101882","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://curl.se/docs/CVE-2021-22876.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00019.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202105-36","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210521-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22876","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ"},{"url":"https://security.netapp.com/advisory/ntap-20210521-0007"},{"url":"https://github.com/advisories/GHSA-jjr6-2g8j-hmwr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-22876","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4511.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22876","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22898","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22925","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-22876","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1617285762.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1634922432.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1643198583.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1773161124.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22876","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0186.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28688","tags":["report"]},{"url":"https://curl.se/docs/CVE-2021-22890.html","tags":["advisory","article"]},{"url":"https://curl.se/changes.html","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22890","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2472","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847916","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1963146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1968013","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2472.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8169","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2020-8169.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8284","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2020-8284.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2020-8285.html","tags":["article"]},{"url":"https://github.com/curl/curl/issues/6255","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8286","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8286","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2020-8286.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22876","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22890","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22901","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22901.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4511","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970902","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4511.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22898","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22898.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22925","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1354","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003191","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1354.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22924","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22924.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22946","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22946.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22947","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22947.html","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4511","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211006-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183933","tags":["report"]},{"url":"https://bugzilla.suse.com/1183934","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22890","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211396-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114707-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211786-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175109","tags":["report"]},{"url":"https://bugzilla.suse.com/1177976","tags":["report"]},{"url":"https://bugzilla.suse.com/1179398","tags":["report"]},{"url":"https://bugzilla.suse.com/1179399","tags":["report"]},{"url":"https://bugzilla.suse.com/1179593","tags":["report"]},{"url":"https://bugzilla.suse.com/1186114","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22898","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211809-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22876","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4898-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4903-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22890","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HDAO4Q3JZASM6AK274RF74JN2GJOK5UE/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22947","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2021-04-01T17:45:18Z","modified":"2026-10-14T10:10:07.988Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-10011","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2021-04-01T17:45:18Z","modified":"2026-10-14T10:10:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-jjr6-2g8j-hmwr","title":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information...","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2022-05-24T17:46:04Z","modified":"2026-10-14T12:31:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-359"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2021-04-01T18:15:12.823Z","modified":"2026-10-14T11:16:52.113Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-359","CWE-200"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"ALPINE-CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2021-04-01T18:15:12.823Z","modified":"2026-10-23T17:17:56.150650657Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-22876","title":"CVE-2021-22876 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:44.451656Z","modified":"2026-01-26T09:48:35.947354Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2021-04-01T18:15:12.823Z","modified":"2026-10-24T10:30:35.28074171Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2021-04-01T18:15:12.823Z","modified":"2026-10-15T09:47:27.823731583Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"JLSEC-2025-26","title":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to...","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2025-10-10T15:04:01.319Z","modified":"2026-07-23T22:30:25.750935406Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2021-1170","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\ncurl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly \u0026quot;short-cut\u0026quot; the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.(CVE-2021-22890)\r\n\r\ncurl 7.1.1 to and including 7.75.0 is vulnerable to an \u0026quot;Exposure of Private Personal Information to an Unauthorized Actor\u0026quot; by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.(CVE-2021-22876)","status":"published","published":"2021-05-06T11:04:24Z","modified":"2026-08-18T01:15:34.133646757Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2472","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update","status":"published","published":"2024-09-22T17:21:11Z","modified":"2026-10-15T10:01:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4511","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T06:20:48Z","modified":"2026-09-21T10:03:10Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2022:1354","title":"Red Hat Security Advisory: rh-dotnet31-curl security update","status":"published","published":"2024-09-16T06:36:12Z","modified":"2026-09-21T10:03:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2021:4511","title":"Moderate: curl security and bug fix update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)\n\n* curl: TELNET stack contents disclosure (CVE-2021-22898)\n\n* curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:38:13Z","modified":"2026-02-04T22:15:08.810995Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.","status":"published","published":"2021-03-31T06:00:00Z","modified":"2026-04-22T12:47:51.003061Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"ALSA-2021:4511","title":"Moderate: curl security and bug fix update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)\n\n* curl: TELNET stack contents disclosure (CVE-2021-22898)\n\n* curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:38:13Z","modified":"2026-10-29T11:01:42.763436957Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2021-1617285762","title":"Fix of CVE-2021-22876","description":"- back-port urlapi from v7.75.0 (used by CVE-2021-22876)\n- strip credentials from the auto-referer header (CVE-2021-22876)","status":"published","published":"2021-04-01T14:02:42Z","modified":"2026-06-01T00:33:15.123728328Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1634922432","title":"Fixed CVE-2021-22876 in curl","description":"- back-port urlapi from v7.75.0 (used by CVE-2021-22876)\n- strip credentials from the auto-referer header (CVE-2021-22876)","status":"published","published":"2021-10-22T17:07:12Z","modified":"2026-06-01T00:33:24.175817554Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1643198583","title":"Fix of CVE: CVE-2021-22876, CVE-2021-22898, CVE-2021-22925","description":"- CVE-2021-22925: fix TELNET stack contents disclosure again\n- CVE-2021-22898: fix TELNET stack contents disclosure\n- CVE-2021-22876: prevent automatic referer from leaking credentials","status":"published","published":"2022-01-26T12:03:03Z","modified":"2026-06-01T00:33:19.120530586Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2026-1773161124","title":"Fix CVE(s): CVE-2021-22876, CVE-2025-15079","description":"   * SECURITY UPDATE: acceptance of hosts not listed in specified known_hosts\n     file during SSH-based transfers\n     - debian/patches/CVE-2025-15079.patch: Set both knownhosts options to same\n       file and fix surprises caused by libssh exposing separate KNOWNHOSTS and\n       GLOBAL_KNOWNHOSTS options.\n     - CVE-2025-15079\n   * Regenerate Server-localhost-lastSAN-sv test certificate with SHA-256\n     - debian/patches/regenerate-lastSAN-cert-sha256.patch: Fix \"ca md too weak\"\n       error with OpenSSL 1.1.1+ by replacing SHA-1 signed certificate with\n       SHA-256. Also fixes Makefile.am bug for lastSAN target.\n   * Update failed test\n     - debian/patches/26_CVE-2021-22876.patch: Update test to avoid using\n       unsupported commands\n   * Update failed test\n     - debian/patches/fix-test323-errorcode.patch: two valid error codes now\n   * Disable some tests\n     - debian/rules: add option to disable tests marked as flaky, fail the\n       build if any test fails\n     - debian/patches/add-flaky-to-test1592.patch: mark test1592 as flaky\n     - debian/patches/disable-nss-failing-tests.patch: libnsspem.so is not\n       available on Debian 10\n   * Remove unsupported test:\n     - debian/patches/test8-verify-that-ctrl-byte-cookies-are-ignored.patch:\n       no ctrl-byte-cookies are supported","status":"published","published":"2026-03-10T16:45:29Z","modified":"2026-06-04T10:03:47.574495Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CURL-CVE-2021-22876","title":"Automatic referer leaks credentials","description":"libcurl does not strip off user credentials from the URL when automatically\npopulating the `Referer:` HTTP request header field in outgoing HTTP requests,\nand therefore risks leaking sensitive data to the server that is the target of\nthe second HTTP request.\n\nlibcurl automatically sets the `Referer:` HTTP request header field in\noutgoing HTTP requests if the `CURLOPT_AUTOREFERER` option is set. With the\ncurl tool, it is enabled with `--referer \";auto\"`.","status":"published","published":"2021-03-31T08:00:00Z","modified":"2026-10-25T01:05:06.250344523Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-2664-1","title":"curl - security update","status":"published","published":"2021-05-17T00:00:00Z","modified":"2026-03-09T01:17:51.594382Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4881-1","title":"curl - security update","status":"published","published":"2021-03-30T00:00:00Z","modified":"2026-03-09T02:10:40.275019Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0186","title":"Updated curl packages fix security vulnerabilities","description":"libcurl does not strip off user credentials from the URL when automatically\npopulating the Referer: HTTP request header field in outgoing HTTP requests,\nand therefore risks leaking sensitive data to the server that is the target of\nthe second HTTP request. (CVE-2021-22876)\n\nTLS 1.3 session ticket proxy host mixup. (CVE-2021-22890)\n","status":"published","published":"2021-04-12T19:59:59Z","modified":"2026-04-16T04:43:38.133881842Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0510-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22890: TLS 1.3 session ticket proxy host mixup (bsc#1183934)\n- CVE-2021-22876: Automatic referer leaks credentials (bsc#1183933)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-04-04T22:05:55Z","modified":"2026-02-04T04:35:50.254268Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10582-1","title":"curl-7.79.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:36.472951Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:1006-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22890: TLS 1.3 session ticket proxy host mixup (bsc#1183934)\n- CVE-2021-22876: Automatic referer leaks credentials (bsc#1183933)\n","status":"published","published":"2021-04-01T15:45:04Z","modified":"2026-02-04T03:36:39.015127Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1396-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).\n","status":"published","published":"2021-04-28T07:23:46Z","modified":"2026-02-04T03:11:49.391203Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:14707-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).\n","status":"published","published":"2021-04-28T07:24:10Z","modified":"2026-02-04T02:13:10.574982Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1786-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n- CVE-2021-22898: TELNET stack contents disclosure (bsc#1186114)\n- CVE-2021-22876: The automatic referer leaks credentials (bsc#1183933)\n- CVE-2020-8286: Inferior OCSP verification (bsc#1179593)\n- CVE-2020-8285: FTP wildcard stack overflow (bsc#1179399)\n- CVE-2020-8284: Trusting FTP PASV responses (bsc#1179398)\n- CVE-2020-8231: libcurl will pick and use the wrong connection with multiple requests with libcurl's multi API and the 'CURLOPT_CONNECT_ONLY' option (bsc#1175109)\n- Fix: SFTP uploads result in empty uploaded files (bsc#1177976)\n","status":"published","published":"2021-05-27T14:45:51Z","modified":"2026-02-04T04:18:37.030331Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1809-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).\n- CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).\n- Fix for SFTP uploads when it results in empty uploaded files (bsc#1177976).\n- Allow partial chain verification (jsc#SLE-17956).\n","status":"published","published":"2021-05-31T14:25:34Z","modified":"2025-05-02T04:31:08.149564Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4898-1","title":"curl vulnerabilities","description":"Viktor Szakats discovered that curl did not strip off user credentials\nfrom referrer header fields. A remote attacker could possibly use this\nissue to obtain sensitive information. (CVE-2021-22876)\n\nMingtao Yang discovered that curl incorrectly handled session tickets when\nusing an HTTPS proxy. A remote attacker in control of an HTTPS proxy could\nuse this issue to bypass certificate checks and intercept communications.\nThis issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10.\n(CVE-2021-22890)\n","status":"published","published":"2021-03-31T10:50:52Z","modified":"2026-04-22T10:13:57.538577Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4903-1","title":"curl vulnerability","description":"Viktor Szakats discovered that curl did not strip off user credentials\nfrom referrer header fields. A remote attacker could possibly use this\nissue to obtain sensitive information.\n","status":"published","published":"2021-04-07T17:09:43Z","modified":"2026-04-22T10:13:28.803474Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}