--- id: CVE-2022-32206 title: >- curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms summary: >- curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was un… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H' cwe: - CWE-770 - CWE-770 vendor: haxx product: curl affected: - curl < 7.84.0 - fedora = 35 - debian_linux = 10.0 - debian_linux = 11.0 - clustered_data_ontap - element_software - hci_management_node - solidfire - bootstrap_os - h300s_firmware - h500s_firmware - h700s_firmware - h410s_firmware - scalance_sc622-2c_firmware < 3.0 - scalance_sc626-2c_firmware < 3.0 - scalance_sc632-2c_firmware < 3.0 - scalance_sc636-2c_firmware < 3.0 - scalance_sc642-2c_firmware < 3.0 - scalance_sc646-2c_firmware < 3.0 - 'universal_forwarder >= 8.2.0, < 8.2.12' - 'universal_forwarder >= 9.0.0, < 9.0.6' - universal_forwarder = 9.1.0 patched: - curl 7.84.0 - scalance_sc622-2c_firmware 3.0 - scalance_sc626-2c_firmware 3.0 - scalance_sc632-2c_firmware 3.0 - scalance_sc636-2c_firmware 3.0 - scalance_sc642-2c_firmware 3.0 - scalance_sc646-2c_firmware 3.0 - universal_forwarder 9.0.6 published: '2022-07-07' updated: '2026-10-14' sourceUpdated: '2026-10-14T17:17:39.160' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-32206' references: - url: 'http://seclists.org/fulldisclosure/2022/Oct/28' label: support@hackerone.com - url: 'http://seclists.org/fulldisclosure/2022/Oct/41' label: support@hackerone.com - url: 'http://www.openwall.com/lists/oss-security/2023/02/15/3' label: support@hackerone.com - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf' label: support@hackerone.com - url: 'https://hackerone.com/reports/1570651' label: support@hackerone.com - url: 'https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html' label: support@hackerone.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ label: support@hackerone.com - url: 'https://security.gentoo.org/glsa/202212-01' label: support@hackerone.com - url: 'https://security.netapp.com/advisory/ntap-20220915-0003/' label: support@hackerone.com - url: 'https://support.apple.com/kb/HT213488' label: support@hackerone.com - url: 'https://www.debian.org/security/2022/dsa-5197' label: support@hackerone.com - url: 'http://seclists.org/fulldisclosure/2022/Oct/28' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2022/Oct/41' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/02/15/3' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://hackerone.com/reports/1570651' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202212-01' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20220915-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213488' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2022/dsa-5197' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-333517.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-419740.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-558014.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-942865.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.33097 epssPercentile: 0.98345 ingestedAt: '2026-10-14T17:44:53.599Z' --- ## Overview curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. ## Affected - `curl < 7.84.0` - `fedora = 35` - `debian_linux = 10.0` - `debian_linux = 11.0` - `clustered_data_ontap` - `element_software` - `hci_management_node` - `solidfire` - `bootstrap_os` - `h300s_firmware` - `h500s_firmware` - `h700s_firmware` - `h410s_firmware` - `scalance_sc622-2c_firmware < 3.0` - `scalance_sc626-2c_firmware < 3.0` - `scalance_sc632-2c_firmware < 3.0` - `scalance_sc636-2c_firmware < 3.0` - `scalance_sc642-2c_firmware < 3.0` - `scalance_sc646-2c_firmware < 3.0` - `universal_forwarder >= 8.2.0, < 8.2.12` - `universal_forwarder >= 9.0.0, < 9.0.6` - `universal_forwarder = 9.1.0` ## Remediation Upgrade past the affected range: - `curl 7.84.0` - `scalance_sc622-2c_firmware 3.0` - `scalance_sc626-2c_firmware 3.0` - `scalance_sc632-2c_firmware 3.0` - `scalance_sc636-2c_firmware 3.0` - `scalance_sc642-2c_firmware 3.0` - `scalance_sc646-2c_firmware 3.0` - `universal_forwarder 9.0.6`