3.1

CVE-2021-22898: debian debian_linux

CVSS: 3.1v3.1LowModified
AliasesALPINE-CVE-2021-22898MGASA-2021-0243SUSE-SU-2021:14735-1
Published 11-06-2021Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2021-22898 is a low (CVSS 3.1) vulnerability in debian debian_linux. EPSS estimates a 4.51% chance of exploitation in the next 30 days, higher than 91.3% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
23/100
0100
Low · default modelHow is this calculated?
CVSS score
3.1/10
010
Low · v3.1 (CVE.org)
EPSS score
4.51%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 10 · Related 6
DLA-2734-1DLA-3085-1DSA-5197-1OPENSUSE-SU-2024:10582-1RHSA-2021:4511SUSE-SU-2021:1786-1

Timeline

  1. 11-06-2021
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

4.51%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.51% on 18-09-2026

18-09-202618-10-2026
EPSS score
4.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (hackerone.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (curl.se)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse9 products
  • curl-openssl1&distro=SUSE Linux Enterprise Server 11-SECURITY< 7.37.0-70.63.1 | < 7.37.0-70.66.1
  • curl&distro=SUSE Linux Enterprise Micro 5.0< 7.66.0-4.17.1
  • curl&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 7.66.0-4.17.1
  • curl&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 7.66.0-4.17.1
  • curl&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 7.37.0-70.66.1
Oracle7 products
Opensuse4 products
  • curl-mini&distro=openSUSE Leap 15.2< 7.66.0-lp152.3.18.1
  • curl-mini&distro=openSUSE Leap 15.3< 7.66.0-4.17.1
  • curl&distro=openSUSE Leap 15.2< 7.66.0-lp152.3.18.1
  • curl&distro=openSUSE Leap 15.3< 7.66.0-4.17.1
Debian2 products
Mageia2 products
  • curl< 7.71.0-1.3.mga7
  • curl< 7.74.0-1.2.mga8
Alpine1 product
  • curl≥ 7.7, < 7.66.0-r4 | ≥ 7.7, < 7.67.0-r4 | ≥ 7.7, < 7.77.0-r0
Fedoraproject1 product
Haxx1 product
  • curl≥ 7.7, ≤ 7.76.1
Siemens1 product
Splunk1 product
Ubuntu1 product
  • curl< 7.35.0-1ubuntu2.20+esm14 | < 7.47.0-1ubuntu2.19+esm3 | < 7.58.0-2ubuntu3.14 | < 7.68.0-1ubuntu2.6

11 vendors · 30 products

References

34 links
Show all 34 references