CVE-2021-22946: Apple macOS

High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Affected products

  • Apple macOS: before 12.3 (fixed in 12.3)
  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 33 only; version 35 only
  • Haxx Curl: from 7.20.0, before 7.79.0 (fixed in 7.79.0)
  • Netapp Cloud Backup: affected versions not specified
  • Netapp Clustered Data Ontap: affected versions not specified
  • Netapp h300e Firmware: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500e Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700e Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Netapp Oncommand Insight: affected versions not specified
  • Netapp Oncommand Workflow Automation: affected versions not specified
  • Netapp Snapcenter: affected versions not specified
  • Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
  • Oracle Commerce Guided Search: version 11.3.2 only
  • Oracle Communications Cloud Native Core Binding Support Function: version 1.11.0 only; version 22.1.3 only
  • Oracle Communications Cloud Native Core Console: version 22.2.0 only
  • Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
  • Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 1.15.1 only; version 22.1.0 only; version 22.2.0 only
  • Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only
  • Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 22.1.1 only
  • Oracle Communications Cloud Native Core Service Communication Proxy: version 1.15.0 only
  • and 4 more

Published 2021-09-29. Last modified 2026-06-17.