CVE-2021-22898: Debian Linux

Low severity, CVSS 3.1. EPSS: 4.5% chance of exploitation in the next 30 days.

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Affected products

Debian Debian Linux: version 9.0 only
Fedoraproject Fedora: version 33 only; version 34 only
Haxx Curl: from 7.7, up to and including 7.76.1
Oracle Communications Cloud Native Core Binding Support Function: version 1.11.0 only
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 1.15.1 only
Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only
Oracle Communications Cloud Native Core Service Communication Proxy: version 1.15.0 only
Oracle Essbase: before 11.1.2.4.047 (fixed in 11.1.2.4.047); from 21.0, before 21.3 (fixed in 21.3)
Oracle MySQL Server: before 5.7.34 (fixed in 5.7.34); from 8.0.15, before 8.0.25 (fixed in 8.0.25)
Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2021-06-11. Last modified 2026-06-17.