---
id: CVE-2022-42916
title: >-
  In curl before 7.86.0, the HSTS check could be bypassed to trick it into
  staying with HTTP
summary: >-
  In curl before 7.86.0, the HSTS check could be bypassed to trick it into
  staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS
  directly (instead of using an insecure cleartext HTTP step) even when HTTP is
  provide…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-319
  - CWE-319
vendor: haxx
product: curl
affected:
  - 'curl >= 7.77.0, < 7.86.0'
  - fedora = 35
  - fedora = 36
  - fedora = 37
  - macos < 12.6.3
  - 'macos >= 13.0, < 13.2'
  - 'universal_forwarder >= 8.2.0, < 8.2.12'
  - 'universal_forwarder >= 9.0.0, < 9.0.6'
  - universal_forwarder = 9.1.0
patched:
  - curl 7.86.0
  - macos 13.2
  - universal_forwarder 9.0.6
published: '2022-10-29'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:16:52.987'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-42916'
references:
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/19'
    label: cve@mitre.org
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/20'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2022/12/21/1'
    label: cve@mitre.org
  - url: 'https://curl.se/docs/CVE-2022-42916.html'
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202212-01'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20221209-0010/'
    label: cve@mitre.org
  - url: 'https://support.apple.com/kb/HT213604'
    label: cve@mitre.org
  - url: 'https://support.apple.com/kb/HT213605'
    label: cve@mitre.org
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/19'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://seclists.org/fulldisclosure/2023/Jan/20'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2022/12/21/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://curl.se/docs/CVE-2022-42916.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202212-01'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20221209-0010/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT213604'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT213605'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-892048.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.01846
epssPercentile: 0.7863
ingestedAt: '2026-10-14T19:49:57.522Z'
---

## Overview

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

## Affected

- `curl >= 7.77.0, < 7.86.0`
- `fedora = 35`
- `fedora = 36`
- `fedora = 37`
- `macos < 12.6.3`
- `macos >= 13.0, < 13.2`
- `universal_forwarder >= 8.2.0, < 8.2.12`
- `universal_forwarder >= 9.0.0, < 9.0.6`
- `universal_forwarder = 9.1.0`

## Remediation

Upgrade past the affected range:

- `curl 7.86.0`
- `macos 13.2`
- `universal_forwarder 9.0.6`