CVE-2021-22876: Broadcom Fabric Operating System

Medium severity, CVSS 5.3. EPSS: 5.3% chance of exploitation in the next 30 days.

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Affected products

• Broadcom Fabric Operating System: affected versions not specified
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Haxx Libcurl: from 7.1.1, up to and including 7.75.0
• Netapp Hci Compute Node: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Hci Storage Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Oracle Communications Billing And Revenue Management: version 12.0.0.3.0 only
• Oracle Essbase: version 21.2 only
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2021-04-01. Last modified 2026-06-17.