CVE-2022-32206: Debian Linux
Medium severity, CVSS 6.5. EPSS: 33.1% chance of exploitation in the next 30 days.
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
Affected products
- Debian Debian Linux: version 10.0 only; version 11.0 only
- Fedoraproject Fedora: version 35 only
- Haxx Curl: before 7.84.0 (fixed in 7.84.0)
- Netapp Bootstrap OS: affected versions not specified
- Netapp Clustered Data Ontap: affected versions not specified
- Netapp Element Software: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Netapp Hci Management Node: affected versions not specified
- Netapp Solidfire: affected versions not specified
- Siemens Scalance SC622-2c Firmware: before 3.0 (fixed in 3.0)
- Siemens Scalance SC626-2c Firmware: before 3.0 (fixed in 3.0)
- Siemens Scalance SC632-2c Firmware: before 3.0 (fixed in 3.0)
- Siemens Scalance SC636-2c Firmware: before 3.0 (fixed in 3.0)
- Siemens Scalance SC642-2c Firmware: before 3.0 (fixed in 3.0)
- Siemens Scalance SC646-2c Firmware: before 3.0 (fixed in 3.0)
- Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only
Published 2022-07-07. Last modified 2026-06-17.