CVE-2021-22901: Haxx Curl
High severity, CVSS 8.1. EPSS: 60.1% chance of exploitation in the next 30 days.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.
Affected products
- Haxx Curl: from 7.75.0, up to and including 7.76.1
- Netapp Active Iq Unified Manager: affected versions not specified
- Netapp Cloud Backup: affected versions not specified
- Netapp h300e Firmware: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500e Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700e Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Netapp Hci Compute Node Firmware: affected versions not specified
- Netapp Oncommand Insight: affected versions not specified
- Netapp Oncommand Workflow Automation: affected versions not specified
- Netapp Snapcenter: affected versions not specified
- Netapp Solidfire, Enterprise Sds & Hci Storage Node: affected versions not specified
- Netapp Solidfire & Hci Management Node: affected versions not specified
- Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
- Oracle Communications Cloud Native Core Binding Support Function: version 1.11.0 only
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
- Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 1.15.1 only
- Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only
- Oracle Communications Cloud Native Core Service Communication Proxy: version 1.15.0 only
- Oracle Essbase: before 11.1.2.4.047 (fixed in 11.1.2.4.047); from 21.0, before 21.3 (fixed in 21.3)
- Oracle MySQL Server: up to and including 5.7.34; from 8.0.0, up to and including 8.0.25
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
- and 1 more
Published 2021-06-11. Last modified 2026-10-08.