CVE-2022-32205: Apple macOS

Medium severity, CVSS 4.3. EPSS: 27.9% chance of exploitation in the next 30 days.

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

Affected products

  • Apple macOS: before 13.0 (fixed in 13.0)
  • Debian Debian Linux: version 11.0 only
  • Fedoraproject Fedora: version 35 only
  • Haxx Curl: from 7.71.0, before 7.84.0 (fixed in 7.84.0)
  • Netapp Clustered Data Ontap: affected versions not specified
  • Netapp Element Software: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Netapp Hci Management Node: affected versions not specified
  • Netapp Solidfire: affected versions not specified
  • Siemens Scalance SC622-2c Firmware: before 3.0 (fixed in 3.0)
  • Siemens Scalance SC626-2c Firmware: before 3.0 (fixed in 3.0)
  • Siemens Scalance SC632-2c Firmware: before 3.0 (fixed in 3.0)
  • Siemens Scalance SC636-2c Firmware: before 3.0 (fixed in 3.0)
  • Siemens Scalance SC642-2c Firmware: before 3.0 (fixed in 3.0)
  • Siemens Scalance SC646-2c Firmware: before 3.0 (fixed in 3.0)
  • Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2022-07-07. Last modified 2026-06-17.