---
id: CVE-2022-32221
title: >-
  When doing HTTP(S) transfers, libcurl might erroneously use the read callback
  (`CURLOPT_READFUNCTION`) to ask for data to send, even when the
  `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was
  used to issue a `PU…
summary: >-
  When doing HTTP(S) transfers, libcurl might erroneously use the read callback
  (`CURLOPT_READFUNCTION`) to ask for data to send, even when the
  `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was
  used to issue a `PU…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-200
  - CWE-668
vendor: haxx
product: curl
affected:
  - curl < 7.86.0
  - clustered_data_ontap
  - h300s_firmware
  - h500s_firmware
  - h700s_firmware
  - h410s_firmware
  - debian_linux = 10.0
  - debian_linux = 11.0
  - macos < 12.6.3
  - 'universal_forwarder >= 8.2.0, < 8.2.12'
  - 'universal_forwarder >= 9.0.0, < 9.0.6'
  - universal_forwarder = 9.1.0
patched:
  - curl 7.86.0
  - macos 12.6.3
  - universal_forwarder 9.0.6
published: '2022-12-05'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:17:39.893'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-32221'
references:
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/19'
    label: support@hackerone.com
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/20'
    label: support@hackerone.com
  - url: 'http://www.openwall.com/lists/oss-security/2023/05/17/4'
    label: support@hackerone.com
  - url: 'https://hackerone.com/reports/1704017'
    label: support@hackerone.com
  - url: 'https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html'
    label: support@hackerone.com
  - url: 'https://security.gentoo.org/glsa/202212-01'
    label: support@hackerone.com
  - url: 'https://security.netapp.com/advisory/ntap-20230110-0006/'
    label: support@hackerone.com
  - url: 'https://security.netapp.com/advisory/ntap-20230208-0002/'
    label: support@hackerone.com
  - url: 'https://support.apple.com/kb/HT213604'
    label: support@hackerone.com
  - url: 'https://support.apple.com/kb/HT213605'
    label: support@hackerone.com
  - url: 'https://www.debian.org/security/2023/dsa-5330'
    label: support@hackerone.com
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/19'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/20'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2023/05/17/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://hackerone.com/reports/1704017'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202212-01'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230110-0006/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230208-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT213604'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT213605'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2023/dsa-5330'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-892048.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.04676
epssPercentile: 0.91628
ingestedAt: '2026-10-14T17:44:53.601Z'
---

## Overview

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

## Affected

- `curl < 7.86.0`
- `clustered_data_ontap`
- `h300s_firmware`
- `h500s_firmware`
- `h700s_firmware`
- `h410s_firmware`
- `debian_linux = 10.0`
- `debian_linux = 11.0`
- `macos < 12.6.3`
- `universal_forwarder >= 8.2.0, < 8.2.12`
- `universal_forwarder >= 9.0.0, < 9.0.6`
- `universal_forwarder = 9.1.0`

## Remediation

Upgrade past the affected range:

- `curl 7.86.0`
- `macos 12.6.3`
- `universal_forwarder 9.0.6`