{"id":"CVE-2021-22925","aliases":["ALPINE-CVE-2021-22925","ALSA-2021:4511","AZL-6363","BELL-CVE-2021-22925","CLSA-2021-1632261944","CLSA-2021-1634922501","CLSA-2021-1634922517","CLSA-2021-1635459174","CLSA-2022-1643198583","CURL-CVE-2021-22925","EUVD-2021-10054","GHSA-rjqf-6h27-xqfp","JLSEC-2026-1337","MGASA-2021-0384","OESA-2021-1321","RHSA-2021:4511","RLSA-2021:4511","SUSE-SU-2021:14768-1","SUSE-SU-2021:2425-1","SUSE-SU-2021:2439-1","SUSE-SU-2021:2440-1","SUSE-SU-2021:2462-1","UBUNTU-CVE-2021-22925","USN-5021-1","USN-5021-2","USN-5894-1","openSUSE-SU-2021:1088-1","openSUSE-SU-2021:2439-1"],"status":"published","title":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This...","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.05367,"percentile":0.92753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-908"],"published":"2021-07-21T00:00:00Z","modified":"2026-10-29T11:01:42Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.67.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.78.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["7.76.0-5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"curl","fixed_in":["7.19.7-58.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libcurl","fixed_in":["7.19.7-58.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","fixed_in":["7.19.7-58.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"curl","fixed_in":["7.19.7-57.el6.cloudlinux.ol.els6","7.19.7-58.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","fixed_in":["7.19.7-57.el6.cloudlinux.ol.els6","7.19.7-58.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","fixed_in":["7.19.7-57.el6.cloudlinux.ol.els6","7.19.7-58.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","fixed_in":["7.47.0-1ubuntu2.21"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.81.0+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.19+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.67.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7"},{"fixed":"7.78.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.0-5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-58.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-58.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-58.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-57.el6.cloudlinux.ol.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-57.el6.cloudlinux.ol.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-57.el6.cloudlinux.ol.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-58.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-58.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-58.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.21"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-18.el8.4.2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.81.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-22.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.71.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.47.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm14"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm3"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.14"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.6"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.14"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.6"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm3"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm14"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm7"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.22.1"}]}],"bundled":4}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"macos"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"solidfire"},{"vendor":"oracle","product":"mysql_server"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"siemens","product":"sinema_remote_connect_server"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1223882","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/40","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/39","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210902-0003/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT212805","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT212804","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202212-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-484086.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22925","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V"},{"url":"https://security.netapp.com/advisory/ntap-20210902-0003"},{"url":"https://github.com/advisories/GHSA-rjqf-6h27-xqfp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-22925","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4511.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22876","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22898","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22925","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-22925","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1632261944.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1634922501.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1634922517.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459174","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1643198583.html","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0384.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29278","tags":["report"]},{"url":"https://curl.se/docs/CVE-2021-22922.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22923.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22924.html","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22925.html","tags":["advisory","report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-July/009187.html","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22926","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4511","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970902","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4511.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22898","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2021-22898.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22925","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4511","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114768-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188217","tags":["report"]},{"url":"https://bugzilla.suse.com/1188218","tags":["report"]},{"url":"https://bugzilla.suse.com/1188219","tags":["report"]},{"url":"https://bugzilla.suse.com/1188220","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22925","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212425-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212439-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212440-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212462-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22925","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5021-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5021-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5894-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-22924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-43552","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SZZR7BLPD5OE5IYY5QBKBYQGD4PESB24/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SZEKWBHHW6CCB43EQZT3OXNG7LXABDJB/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-22925","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2021-08-05T00:00:00Z","modified":"2026-10-14T11:08:19.129Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-10054","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2021-08-05T00:00:00Z","modified":"2026-10-14T11:08:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:16.356399Z"}],"ghsa":[{"id":"GHSA-rjqf-6h27-xqfp","title":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This...","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2022-05-24T19:10:07Z","modified":"2026-10-14T12:32:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-908"],"updated_at":"2026-11-02T15:13:24.812204Z"}],"nvd":[{"id":"CVE-2021-22925","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2021-08-05T21:15:11.467Z","modified":"2026-10-14T11:16:54.113Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-908"],"updated_at":"2026-11-02T14:06:56.562207Z"}],"osv":[{"id":"ALPINE-CVE-2021-22925","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2021-08-05T21:15:11.467Z","modified":"2026-10-23T17:17:56.154228945Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6363","title":"CVE-2021-22925 affecting package curl for versions less than 7.76.0-5","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2021-08-05T21:15:11Z","modified":"2026-04-21T04:32:11.269537Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2021-22925","title":"CVE-2021-22925 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:18.564686Z","modified":"2026-01-26T09:46:43.946018Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-22925","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2021-08-05T21:15:11.467Z","modified":"2026-10-24T10:30:37.085221263Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"JLSEC-2026-1337","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2026-08-17T13:15:13.4Z","modified":"2026-08-17T13:30:03.156588647Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2021-1321","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\r\n\r\ncurl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.(CVE-2021-22925)\r\n\r\nlibcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.(CVE-2021-22926)","status":"published","published":"2021-08-20T11:04:33Z","modified":"2026-08-18T01:15:51.801658975Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4511","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T06:20:48Z","modified":"2026-09-21T10:03:10Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4511","title":"Moderate: curl security and bug fix update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)\n\n* curl: TELNET stack contents disclosure (CVE-2021-22898)\n\n* curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:38:13Z","modified":"2026-02-04T22:15:08.810995Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-22925","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.","status":"published","published":"2021-07-21T00:00:00Z","modified":"2026-04-27T09:13:44.416297Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"ALSA-2021:4511","title":"Moderate: curl security and bug fix update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)\n\n* curl: TELNET stack contents disclosure (CVE-2021-22898)\n\n* curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:38:13Z","modified":"2026-10-29T11:01:42.763436957Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2021-1632261944","title":"Fix of CVE: CVE-2021-22925","description":"- telnet stack contents disclosure again (CVE-2021-22925)","status":"published","published":"2021-09-21T22:05:44Z","modified":"2026-06-01T00:33:14.992913665Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1634922501","title":"Fixed CVE-2021-22925 in curl","description":"- telnet stack contents disclosure again (CVE-2021-22925)","status":"published","published":"2021-10-22T17:08:21Z","modified":"2026-06-01T00:33:24.048725299Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1634922517","title":"Fixed CVE-2021-22925 in curl","description":"- telnet stack contents disclosure again (CVE-2021-22925)","status":"published","published":"2021-10-22T17:08:37Z","modified":"2026-06-01T00:33:24.030351808Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1635459174","title":"Fix CVE(s): CVE-2021-22925","description":"\n   * SECURITY UPDATE:  TELNET stack contents disclosure again\n     - debian/patches/CVE-2021-22925.patch: check sscanf() for correct number\n     - of matches in lib/telnet.c\n     - CVE-2021-22925","status":"published","published":"2021-10-28T22:12:54Z","modified":"2026-06-04T10:03:36.70166Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1643198583","title":"Fix of CVE: CVE-2021-22876, CVE-2021-22898, CVE-2021-22925","description":"- CVE-2021-22925: fix TELNET stack contents disclosure again\n- CVE-2021-22898: fix TELNET stack contents disclosure\n- CVE-2021-22876: prevent automatic referer from leaking credentials","status":"published","published":"2022-01-26T12:03:03Z","modified":"2026-06-01T00:33:19.120530586Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CURL-CVE-2021-22925","title":"TELNET stack contents disclosure again","description":"curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`\nin libcurl. This rarely used option is used to send variable=content pairs to\nTELNET servers.\n\nDue to flaw in the option parser for sending `NEW_ENV` variables, libcurl\ncould be made to pass on uninitialized data from a stack based buffer to the\nserver. Therefore potentially revealing sensitive internal information to the\nserver using a clear-text network protocol.\n\nThis could happen because curl did not call and use `sscanf()` correctly when\nparsing the string provided by the application.\n\nThe previous curl security vulnerability\n[CVE-2021-22898](https://curl.se/docs/CVE-2021-22898.html) is almost identical\nto this one but the fix was insufficient so this security vulnerability\nremained.","status":"published","published":"2021-07-21T08:00:00Z","modified":"2026-10-25T01:05:30.556980788Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"MGASA-2021-0384","title":"Updated curl packages fix security vulnerabilities","description":"Wrong content via metalink not discarded (CVE-2021-22922).\n\nMetalink download sends credentials (CVE-2021-22923).\n\nBad connection reuse due to flawed path name checks (CVE-2021-22924).\n\nTELNET stack contents disclosure again (CVE-2021-22925).\n","status":"published","published":"2021-07-27T20:21:53Z","modified":"2026-04-16T04:44:00.050335464Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:1088-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)\n- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)\n- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)\n- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-07-24T16:05:42Z","modified":"2026-02-04T03:16:59.343405Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2439-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)\n- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)\n- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)\n- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)\n","status":"published","published":"2021-07-21T11:47:07Z","modified":"2025-05-07T18:12:31.281466Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:14768-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)\n- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)\n- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)\n- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)\n","status":"published","published":"2021-07-21T11:45:42Z","modified":"2026-02-04T04:28:31.483488Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2425-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)\n- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)\n- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)\n- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)\n","status":"published","published":"2021-07-21T09:26:20Z","modified":"2026-02-04T03:17:38.996645Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2439-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)\n- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)\n- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)\n- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)\n","status":"published","published":"2021-07-21T11:47:05Z","modified":"2026-02-04T03:24:43.058528Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2440-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)\n- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)\n- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)\n- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)\n","status":"published","published":"2021-07-21T11:48:57Z","modified":"2026-02-04T03:41:49.466305Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2462-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)\n- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)\n- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)\n- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)\n","status":"published","published":"2021-07-23T09:23:31Z","modified":"2026-02-04T04:33:01.619157Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5021-1","title":"curl vulnerabilities","description":"Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled\nTELNET connections when the -t option was used on the command line.\nUninitialized data possibly containing sensitive information could be sent\nto the remote server, contrary to expectations. (CVE-2021-22898,\nCVE-2021-22925)\n\nHarry Sintonen discovered that curl incorrectly reused connections in the\nconnection pool. This could result in curl reusing the wrong connections.\n(CVE-2021-22924)\n","status":"published","published":"2021-07-22T18:17:55Z","modified":"2026-04-27T09:18:25.635931Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5021-2","title":"curl vulnerability","description":"USN-5021-1 fixed vulnerabilities in curl. This update provides\nthe corresponding updates for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled\n TELNET connections when the -t option was used on the command line.\n Uninitialized data possibly containing sensitive information could be sent\n to the remote server, contrary to expectations. (CVE-2021-22898,\n CVE-2021-22925)\n","status":"published","published":"2022-01-20T11:40:36Z","modified":"2026-06-25T13:30:41.010944234Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5894-1","title":"curl vulnerabilities","description":"Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled\nTELNET connections when the -t option was used on the command line.\nUninitialized data possibly containing sensitive information could be sent\nto the remote server, contrary to expectations. This issue was only fixed\nin Ubuntu 14.04 ESM. (CVE-2021-22898, CVE-2021-22925)\n\nIt was discovered that curl incorrectly handled denials when using HTTP\nproxies. A remote attacker could use this issue to cause curl to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2022-43552)\n","status":"published","published":"2023-02-27T14:10:27Z","modified":"2026-06-29T13:50:46.648994714Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}