CVE-2022-27781: debian debian_linux Uncontrolled Resource Consumption
Vulnerability summary
CVE-2022-27781 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 2.90% chance of exploitation in the next 30 days, higher than 86.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 12 · Related 8Timeline
- 01-06-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.90%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
+0.15 pp
From 2.75% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected systems
Netapp9 products
Debian2 products
- curl< 7.83.1-1
- debian_linuxEOL10.0 | 11.0
Alpine1 product
- curl< 7.79.1-r2 | < 7.80.0-r2 | < 7.83.1-r0
Haxx1 product
- curl< 7.83.1
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curl< 7.35.0-1ubuntu2.20+esm11 | < 7.47.0-1ubuntu2.19+esm4 | < 7.58.0-2ubuntu3.18 | < 7.68.0-1ubuntu2.11 | < 7.81.0-1ubuntu1.2
6 vendors · 15 products
References
16 links- security.netapp.com/advisory/ntap-20220609-0009/Third Party Advisory
