CVE-2022-32221: apple macos
Vulnerability summary
CVE-2022-32221 is a critical (CVSS 9.8) vulnerability in apple macos. EPSS estimates a 5.09% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 8Timeline
- 05-12-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
CVSS metrics
8 scores · 8 sources · 1 version- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.09%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
+0.64 pp
From 4.45% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Suse17 products
- curl&distro=SUSE Enterprise Storage 7< 7.66.0-150200.4.42.1
- curl&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 7.66.0-150200.4.42.1
- curl&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 7.66.0-150200.4.42.1
- curl&distro=SUSE Linux Enterprise Micro 5.1< 7.66.0-150200.4.42.1
- curl&distro=SUSE Linux Enterprise Micro 5.2< 7.66.0-150200.4.42.1
Redhat10 products
- curl< 0:7.76.1-19.el9_1.1
- curl-debuginfo< 0:7.76.1-19.el9_1.1
- curl-debugsource< 0:7.76.1-19.el9_1.1
- curl-minimal< 0:7.76.1-19.el9_1.1
- curl-minimal-debuginfo< 0:7.76.1-19.el9_1.1
Netapp5 products
Debian2 products
- curl< 7.86.0-1
- debian_linuxEOL10.0 | 11.0
Opensuse2 products
- curl&distro=openSUSE Leap 15.3< 7.66.0-150200.4.42.1
- curl&distro=openSUSE Leap Micro 5.2< 7.66.0-150200.4.42.1
Alpine1 product
- curl< 7.80.0-r4 | < 7.83.1-r4 | < 7.86.0-r0
Apple1 product
- macos< 12.6.3
Chainguard1 product
- curl< 7.86.0-r0
Haxx1 product
- curl< 7.86.0
Mageia1 product
- curl< 7.74.0-1.9.mga8
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curl< 7.58.0-2ubuntu3.21 | < 7.68.0-1ubuntu2.14 | < 7.81.0-1ubuntu1.6 | < 7.35.0-1ubuntu2.20+esm13 | < 7.47.0-1ubuntu2.19+esm6
Wolfi1 product
- curl< 7.86.0-r0
13 vendors · 44 products
