{"id":"CVE-2022-35260","aliases":["ALPINE-CVE-2022-35260","AZL-38755","BELL-CVE-2022-35260","CURL-CVE-2022-35260","DEBIAN-CVE-2022-35260","EUVD-2022-38151","GHSA-pv52-98qj-pq55","JLSEC-2026-1341","openSUSE-SU-2024:12447-1"],"status":"published","title":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095...","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02704,"percentile":0.86056,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2022-10-26T08:00:00Z","modified":"2026-11-03T08:02:20Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.86.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"tensorflow","fixed_in":["2.16.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.86.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.86.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.86.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.87.0+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.84.0"},{"fixed":"7.86.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.84.0+0"},{"fixed":"7.87.0+0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"apple","product":"macos"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1721098","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://security.gentoo.org/glsa/202212-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230110-0006/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213604","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT213605","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Jan/20","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Jan/19","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-892048.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35260","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230110-0006"},{"url":"https://github.com/advisories/GHSA-pv52-98qj-pq55"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-35260","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-35260","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35260.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-35260","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42916","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-35260","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2026-10-14T17:07:43.189Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-38151","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2026-10-14T17:07:43Z","updated_at":"2026-11-02T17:27:13.785562Z"}],"ghsa":[{"id":"GHSA-pv52-98qj-pq55","title":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095...","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-06T00:30:16Z","modified":"2026-10-14T18:32:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T15:13:28.606179Z"}],"nvd":[{"id":"CVE-2022-35260","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-05T22:15:10.743Z","modified":"2026-10-14T18:17:00.993Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"ALPINE-CVE-2022-35260","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-05T22:15:10.743Z","modified":"2026-11-03T07:18:33.486969159Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-38755","title":"CVE-2022-35260 affecting package tensorflow for versions less than 2.16.1-1","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-05T22:15:10Z","modified":"2026-04-21T04:53:25.577395Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2022-35260","title":"CVE-2022-35260 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:49.449922Z","modified":"2026-01-26T09:49:29.090413Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"DEBIAN-CVE-2022-35260","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-05T22:15:10.743Z","modified":"2026-11-03T08:02:20.389153914Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"JLSEC-2026-1341","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2026-08-17T13:15:13.4Z","modified":"2026-08-17T13:30:04.501946357Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"CURL-CVE-2022-35260","title":".netrc parser out-of-bounds access","description":"curl can be told to parse a `.netrc` file for credentials. If that file ends\nin a line with consecutive non-white space letters and no newline, curl could\nread past the end of the stack-based buffer, and if the read works, write a\nzero byte possibly beyond its boundary.\n\nThis does in most cases cause a segfault or similar, but circumstances might\nalso cause different outcomes.\n\nIf a malicious user can provide a custom netrc file to an application or\notherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-10-26T08:00:00Z","modified":"2026-10-25T01:05:05.858449985Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"CVE-2022-35260","description":"curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2026-10-28T02:30:23.091601187Z","cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"openSUSE-SU-2024:12447-1","title":"curl-7.86.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.86.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:19:19.497867Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}