{"id":"CVE-2022-27780","aliases":["ALPINE-CVE-2022-27780","AZL-9909","BELL-CVE-2022-27780","CLSA-2022-1656430138","CLSA-2022-1656430292","CURL-CVE-2022-27780","DEBIAN-CVE-2022-27780","EUVD-2022-32275","GHSA-82rv-h33p-2xgc","JLSEC-2026-389","UBUNTU-CVE-2022-27780","USN-5412-1","openSUSE-SU-2024:12062-1"],"status":"published","title":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host...","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02524,"percentile":0.84985,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-177","CWE-918"],"published":"2022-05-11T00:00:00Z","modified":"2026-11-03T08:02:16Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.80.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.5.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.83.1+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.80.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.80.0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.5.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.81.0+0"},{"fixed":"7.83.1+0"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.2"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.18"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.11"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.2"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1.1"}]}],"bundled":6}],"products":[{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_bootstrap_os"},{"vendor":"netapp","product":"ontap_9"},{"vendor":"netapp","product":"solidfire\\,_enterprise_sds_\\\u0026_hci_storage_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_storage_node"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1553841","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220609-0009/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202212-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27780","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220609-0009"},{"url":"https://github.com/advisories/GHSA-82rv-h33p-2xgc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-27780","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-27780","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1656430138.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1656430292.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27780.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-27780","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-27780","tags":["report"]},{"url":"https://curl.se/docs/CVE-2022-27780.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5412-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-27780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27782","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30115","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-27780","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-01T00:00:00Z","modified":"2026-10-14T16:20:10.291Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:34:34.250357Z"}],"euvd":[{"id":"EUVD-2022-32275","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-01T00:00:00Z","modified":"2026-10-14T16:20:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-82rv-h33p-2xgc","title":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host...","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-03T00:01:03Z","modified":"2026-10-14T18:32:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-177","CWE-918"],"updated_at":"2026-11-02T15:13:27.339015Z"}],"nvd":[{"id":"CVE-2022-27780","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-02T14:15:44.267Z","modified":"2026-10-14T17:17:37.217Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-177","CWE-918"],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"ALPINE-CVE-2022-27780","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-02T14:15:44.267Z","modified":"2026-11-03T07:18:33.145130897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-9909","title":"CVE-2022-27780 affecting package curl for versions less than 7.83.1-1","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-02T14:15:44Z","modified":"2026-04-21T04:35:10.704255Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2022-27780","title":"CVE-2022-27780 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:10.123275Z","modified":"2026-01-26T09:45:41.305375Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-27780","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-01T00:00:00Z","modified":"2026-10-28T02:30:34.731801137Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-27780","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-06-02T14:15:44.267Z","modified":"2026-11-03T08:02:16.642786408Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"JLSEC-2026-389","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:00:45.760072556Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"UBUNTU-CVE-2022-27780","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.","status":"published","published":"2022-05-11T00:00:00Z","modified":"2026-04-22T13:20:09.994772Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CLSA-2022-1656430138","title":"Fixed CVEs in curl: CVE-2022-27780, CVE-2022-27781, CVE-2022-27782","description":"- CVE-2022-27782: check additional TLS or SSH connection parameters that should\n  have prohibited connection reuse\n- CVE-2022-27781: add limit of certificates which can be traversed breaking\n  possible infinite loop\n- CVE-2022-27780: exclude malicious characters from url to prevent incorrect\n  address decoding","status":"published","published":"2022-06-28T15:28:58Z","modified":"2026-06-01T00:33:19.332913871Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1656430292","title":"Fixed CVEs in curl: CVE-2022-27780, CVE-2022-27782, CVE-2022-27781","description":"- CVE-2022-27782: check additional TLS or SSH connection parameters that should\n  have prohibited connection reuse\n- CVE-2022-27781: add limit of certificates which can be traversed breaking\n  possible infinite loop\n- CVE-2022-27780: exclude malicious characters from url to prevent incorrect\n  address decoding","status":"published","published":"2022-06-28T15:31:32Z","modified":"2026-10-21T10:48:06.641264458Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CURL-CVE-2022-27780","title":"percent-encoded path separator in URL host","description":"The curl URL parser wrongly accepts percent-encoded URL separators like '/'\nwhen decoding the hostname part of a URL, making it a *different* URL using\nthe wrong hostname when it is later retrieved.\n\nFor example, a URL like `http://example.com%2F10.0.0.1/`, would be allowed by\nthe parser and get transposed into `http://example.com/10.0.0.1/`. This flaw\ncan be used to circumvent filters, checks and more.","status":"published","published":"2022-05-11T08:00:00Z","modified":"2026-10-25T01:04:42.522288749Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2024:12062-1","title":"curl-7.83.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.83.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:09:50.406328Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-5412-1","title":"curl vulnerabilities","description":"Axel Chong discovered that curl incorrectly handled percent-encoded URL\nseparators. A remote attacker could possibly use this issue to trick curl\ninto using the wrong URL and bypass certain checks or filters. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2022-27780)\n\nFlorian Kohnhuser discovered that curl incorrectly handled returning a\nTLS server's certificate chain details. A remote attacker could possibly\nuse this issue to cause curl to stop responding, resulting in a denial of\nservice. (CVE-2022-27781)\n\nHarry Sintonen discovered that curl incorrectly reused a previous\nconnection when certain options had been changed, contrary to expectations.\n(CVE-2022-27782)\n","status":"published","published":"2022-05-11T13:14:58Z","modified":"2026-04-27T09:17:49.95873Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}