vulnti.work

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same han…

Critical CVSS 9.8
CVECVE-2022-32221
First seen2026-10-14 19:01 UTC
Disclosed2022-12-05 22:15 UTC
Last updated2026-10-14 19:01 UTC
Channel statusauto

Summary

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle whe…

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

  • :
  • :
  • :
  • :
  • :
  • :
  • :
  • :
  • :

Sources

  • NVD DATABASE

Original Links

Timeline

  1. nvd_ingest NVD