CVE-2022-32206: debian debian_linux

Vulnerability summary

CVE-2022-32206 is a medium (CVSS 6.5) vulnerability in debian debian_linux. EPSS estimates a 36.35% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-07-2022
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.