CVE-2022-32206: haxx curl +18 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-32206

CVSS 6.5 · Medium EPSS 33,1%

Kerentanan Allocation of Resources Without Limits or Throttling pada haxx curl, fedoraproject fedora +17 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

Rincian

Terbit di NVD: 7 Juli 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 33,1% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haxx	curl	Semua versi sebelum 7.84.0
fedoraproject	fedora	Versi 35
debian	debian linux	Versi 10.0
debian	debian linux	Versi 11.0
netapp	clustered data ontap	Semua versi
netapp	element software	Semua versi
netapp	hci management node	Semua versi
netapp	solidfire	Semua versi
netapp	bootstrap os	Semua versi
netapp	h300s firmware	Semua versi
netapp	h500s firmware	Semua versi
netapp	h700s firmware	Semua versi
netapp	h410s firmware	Semua versi
siemens	scalance sc622-2c firmware	Semua versi sebelum 3.0
siemens	scalance sc626-2c firmware	Semua versi sebelum 3.0
siemens	scalance sc632-2c firmware	Semua versi sebelum 3.0
siemens	scalance sc636-2c firmware	Semua versi sebelum 3.0
siemens	scalance sc642-2c firmware	Semua versi sebelum 3.0
siemens	scalance sc646-2c firmware	Semua versi sebelum 3.0
splunk	universal forwarder	Versi 8.2.0 hingga sebelum 8.2.12
splunk	universal forwarder	Versi 9.0.0 hingga sebelum 9.0.6
splunk	universal forwarder	Versi 9.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf patch · advisory pihak ketiga
http://seclists.org/fulldisclosure/2022/Oct/28 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2022/Oct/41 mailing list · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2023/02/15/3 mailing list · advisory pihak ketiga
https://hackerone.com/reports/1570651 exploit · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CE... mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202212-01 advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20220915-0003/ advisory pihak ketiga
https://support.apple.com/kb/HT213488 advisory pihak ketiga
https://www.debian.org/security/2022/dsa-5197 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.