--- id: CVE-2021-22946 title: >- A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withli… summary: >- A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withli… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cwe: - CWE-325 - CWE-319 - CWE-319 vendor: haxx product: curl affected: - 'curl >= 7.20.0, < 7.79.0' - debian_linux = 9.0 - debian_linux = 10.0 - debian_linux = 11.0 - fedora = 33 - fedora = 35 - cloud_backup - clustered_data_ontap - oncommand_insight - oncommand_workflow_automation - snapcenter - h300s_firmware - h500s_firmware - h700s_firmware - h300e_firmware - h500e_firmware - h700e_firmware - h410s_firmware - solidfire_baseboard_management_controller_firmware - communications_cloud_native_core_binding_support_function = 1.11.0 - >- communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0 - communications_cloud_native_core_network_repository_function = 1.15.0 - communications_cloud_native_core_network_repository_function = 1.15.1 - communications_cloud_native_core_network_slice_selection_function = 1.8.0 - communications_cloud_native_core_service_communication_proxy = 1.15.0 - 'mysql_server >= 5.7.0, <= 5.7.35' - 'mysql_server >= 8.0.0, <= 8.0.26' - peoplesoft_enterprise_peopletools = 8.57 - peoplesoft_enterprise_peopletools = 8.58 - peoplesoft_enterprise_peopletools = 8.59 - macos < 12.3 - sinec_infrastructure_network_services < 1.0.1.1 - commerce_guided_search = 11.3.2 - communications_cloud_native_core_binding_support_function = 22.1.3 - communications_cloud_native_core_console = 22.2.0 - communications_cloud_native_core_network_repository_function = 22.1.0 - communications_cloud_native_core_network_repository_function = 22.2.0 - communications_cloud_native_core_security_edge_protection_proxy = 22.1.1 - 'universal_forwarder >= 8.2.0, < 8.2.12' - 'universal_forwarder >= 9.0.0, < 9.0.6' - universal_forwarder = 9.1.0 patched: - curl 7.79.0 - macos 12.3 - sinec_infrastructure_network_services 1.0.1.1 - universal_forwarder 9.0.6 published: '2021-09-29' updated: '2026-10-14' sourceUpdated: '2026-10-14T12:17:08.943' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-22946' references: - url: 'http://seclists.org/fulldisclosure/2022/Mar/29' label: support@hackerone.com - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: support@hackerone.com - url: 'https://hackerone.com/reports/1334111' label: support@hackerone.com - url: 'https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html' label: support@hackerone.com - url: 'https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html' label: support@hackerone.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ label: support@hackerone.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ label: support@hackerone.com - url: 'https://security.gentoo.org/glsa/202212-01' label: support@hackerone.com - url: 'https://security.netapp.com/advisory/ntap-20211029-0003/' label: support@hackerone.com - url: 'https://security.netapp.com/advisory/ntap-20220121-0008/' label: support@hackerone.com - url: 'https://support.apple.com/kb/HT213183' label: support@hackerone.com - url: 'https://www.debian.org/security/2022/dsa-5197' label: support@hackerone.com - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: support@hackerone.com - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: support@hackerone.com - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: support@hackerone.com - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: support@hackerone.com - url: 'http://seclists.org/fulldisclosure/2022/Mar/29' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://hackerone.com/reports/1334111' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202212-01' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20211029-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20220121-0008/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213183' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2022/dsa-5197' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-146325.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-389290.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.04539 epssPercentile: 0.91367 ingestedAt: '2026-10-14T12:29:10.826Z' --- ## Overview A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network. ## Affected - `curl >= 7.20.0, < 7.79.0` - `debian_linux = 9.0` - `debian_linux = 10.0` - `debian_linux = 11.0` - `fedora = 33` - `fedora = 35` - `cloud_backup` - `clustered_data_ontap` - `oncommand_insight` - `oncommand_workflow_automation` - `snapcenter` - `h300s_firmware` - `h500s_firmware` - `h700s_firmware` - `h300e_firmware` - `h500e_firmware` - `h700e_firmware` - `h410s_firmware` - `solidfire_baseboard_management_controller_firmware` - `communications_cloud_native_core_binding_support_function = 1.11.0` - `communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0` - `communications_cloud_native_core_network_repository_function = 1.15.0` - `communications_cloud_native_core_network_repository_function = 1.15.1` - `communications_cloud_native_core_network_slice_selection_function = 1.8.0` - `communications_cloud_native_core_service_communication_proxy = 1.15.0` - `mysql_server >= 5.7.0, <= 5.7.35` - `mysql_server >= 8.0.0, <= 8.0.26` - `peoplesoft_enterprise_peopletools = 8.57` - `peoplesoft_enterprise_peopletools = 8.58` - `peoplesoft_enterprise_peopletools = 8.59` - `macos < 12.3` - `sinec_infrastructure_network_services < 1.0.1.1` - `commerce_guided_search = 11.3.2` - `communications_cloud_native_core_binding_support_function = 22.1.3` - `communications_cloud_native_core_console = 22.2.0` - `communications_cloud_native_core_network_repository_function = 22.1.0` - `communications_cloud_native_core_network_repository_function = 22.2.0` - `communications_cloud_native_core_security_edge_protection_proxy = 22.1.1` - `universal_forwarder >= 8.2.0, < 8.2.12` - `universal_forwarder >= 9.0.0, < 9.0.6` - `universal_forwarder = 9.1.0` ## Remediation Upgrade past the affected range: - `curl 7.79.0` - `macos 12.3` - `sinec_infrastructure_network_services 1.0.1.1` - `universal_forwarder 9.0.6`