CVE-2021-22897: Haxx Curl
Medium severity, CVSS 5.3. EPSS: 3% chance of exploitation in the next 30 days.
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Affected products
- Haxx Curl: from 7.61.0, up to and including 7.76.1
- Netapp Cloud Backup: affected versions not specified
- Netapp h300e Firmware: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500e Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700e Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Netapp Hci Compute Node Firmware: affected versions not specified
- Netapp Solidfire, Enterprise Sds & Hci Storage Node: affected versions not specified
- Netapp Solidfire & Hci Management Node: affected versions not specified
- Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
- Oracle Communications Cloud Native Core Binding Support Function: version 1.11.0 only
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
- Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 1.15.1 only
- Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only
- Oracle Communications Cloud Native Core Service Communication Proxy: version 1.15.0 only
- Oracle Essbase: before 11.1.2.4.047 (fixed in 11.1.2.4.047); from 21.0, before 21.3 (fixed in 21.3)
- Oracle MySQL Server: up to and including 5.7.34; from 8.0.0, up to and including 8.0.25
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
- Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only
Published 2021-06-11. Last modified 2026-06-17.