CVE-2022-27780: haxx curl
Vulnerability summary
CVE-2022-27780 is a high (CVSS 7.5) vulnerability in haxx curl. EPSS estimates a 2.52% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 01-06-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
2.52%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
+0.05 pp
From 2.47% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-177Improper Handling of URL Encoding (Hex Encoding)The product does not properly handle when all or part of an input has been URL encoded.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Netapp8 products
Alpine1 product
- curl≥ 7.80.0, < 7.80.0-r2 | ≥ 7.80.0, < 7.83.1-r0
Debian1 product
- curl< 7.83.1-1
Haxx1 product
- curl≥ 7.80.0, < 7.83.1
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curl< 7.81.0-1ubuntu1.2
6 vendors · 13 products
References
11 links- security.netapp.com/advisory/ntap-20220609-0009/Third Party Advisory
