{"id":"CVE-2021-22898","title":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers","summary":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser f…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cwe":["CWE-200","CWE-909"],"vendor":"haxx","product":"curl","affected":["curl >= 7.7, <= 7.76.1","debian_linux = 9.0","fedora = 33","fedora = 34","communications_cloud_native_core_binding_support_function = 1.11.0","communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0","communications_cloud_native_core_network_repository_function = 1.15.0","communications_cloud_native_core_network_repository_function = 1.15.1","communications_cloud_native_core_network_slice_selection_function = 1.8.0","communications_cloud_native_core_service_communication_proxy = 1.15.0","essbase < 11.1.2.4.047","essbase >= 21.0, < 21.3","mysql_server < 5.7.34","mysql_server >= 8.0.15, < 8.0.25","sinec_infrastructure_network_services < 1.0.1.1","universal_forwarder >= 8.2.0, < 8.2.12","universal_forwarder >= 9.0.0, < 9.0.6","universal_forwarder = 9.1.0"],"patched":["essbase 21.3","mysql_server 8.0.25","sinec_infrastructure_network_services 1.0.1.1","universal_forwarder 9.0.6"],"published":"2021-06-11","updated":"2026-10-14","sourceUpdated":"2026-10-14T11:16:52.873","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-22898","references":[{"url":"http://www.openwall.com/lists/oss-security/2021/07/21/4","label":"support@hackerone.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","label":"support@hackerone.com"},{"url":"https://curl.se/docs/CVE-2021-22898.html","label":"support@hackerone.com"},{"url":"https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde","label":"support@hackerone.com"},{"url":"https://hackerone.com/reports/1176461","label":"support@hackerone.com"},{"url":"https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","label":"support@hackerone.com"},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","label":"support@hackerone.com"},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","label":"support@hackerone.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","label":"support@hackerone.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/","label":"support@hackerone.com"},{"url":"https://www.debian.org/security/2022/dsa-5197","label":"support@hackerone.com"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"support@hackerone.com"},{"url":"http://www.openwall.com/lists/oss-security/2021/07/21/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://curl.se/docs/CVE-2021-22898.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://hackerone.com/reports/1176461","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2022/dsa-5197","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.04507,"epssPercentile":0.91313,"ingestedAt":"2026-10-14T11:27:22.124Z","slug":"CVE-2021-22898","body":"## Overview\n\ncurl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.\n\n## Affected\n\n- `curl >= 7.7, <= 7.76.1`\n- `debian_linux = 9.0`\n- `fedora = 33`\n- `fedora = 34`\n- `communications_cloud_native_core_binding_support_function = 1.11.0`\n- `communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0`\n- `communications_cloud_native_core_network_repository_function = 1.15.0`\n- `communications_cloud_native_core_network_repository_function = 1.15.1`\n- `communications_cloud_native_core_network_slice_selection_function = 1.8.0`\n- `communications_cloud_native_core_service_communication_proxy = 1.15.0`\n- `essbase < 11.1.2.4.047`\n- `essbase >= 21.0, < 21.3`\n- `mysql_server < 5.7.34`\n- `mysql_server >= 8.0.15, < 8.0.25`\n- `sinec_infrastructure_network_services < 1.0.1.1`\n- `universal_forwarder >= 8.2.0, < 8.2.12`\n- `universal_forwarder >= 9.0.0, < 9.0.6`\n- `universal_forwarder = 9.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `essbase 21.3`\n- `mysql_server 8.0.25`\n- `sinec_infrastructure_network_services 1.0.1.1`\n- `universal_forwarder 9.0.6`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":17.1,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[]}