dbcve.org
CurlApplication · Haxx

CVE-2022-42915

HIGH · 8.1 CVSS v3.1 Published 2022-10-29
Fix available
A fix is available. Upgrade to 7.86.0 / 12.6.3 or later.
See remediation →
90/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

curl before 7.86.0 contains a double free vulnerability in its HTTP proxy handling. When curl uses an HTTP proxy for non-HTTP(S) URL schemes (dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet) and the proxy rejects the CONNECT request with a non-200 status code, flawed error/cleanup handling triggers a double free condition.

MitigationUpgrade curl to version 7.86.0 or later. As a temporary workaround, avoid using HTTP proxies with non-HTTP(S) URL schemes until the upgrade is applied.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
CurlApplication
Affected:>= 7.77.0, < 7.86.0
FedoraOperating system
Affected:= 35= 36= 37
H300s FirmwareOperating system
Affected:all versions
H500s FirmwareOperating system
Affected:all versions
H700s FirmwareOperating system
Affected:all versions
H410s FirmwareOperating system
Affected:all versions
Ontap 9Application
Affected:all versions
macOSOperating system
Affected:>= 12.0.0, < 12.6.3>= 13.0, < 13.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check installed curl version
    Run 'curl --version' or check the curl package version using the system's package manager (dpkg, rpm, yum, brew, etc.)
    Affected if Version is 7.77.0 through 7.85.x (any version >= 7.77.0 but < 7.86.0)
  2. Verify HTTP proxy environment variables
    Check for HTTP_PROXY, http_proxy, HTTPS_PROXY, https_proxy, ALL_PROXY, or all_proxy environment variables set in the shell or system-wide
    Affected if Any HTTP proxy environment variable is set and exported
  3. Identify non-HTTP(S) URL scheme usage through proxy
    Review application behavior, logs, or code that makes curl requests to non-HTTP(S) protocols: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet
    Affected if Applications or scripts use curl with any of these URL schemes while an HTTP proxy is configured
  4. Check proxy rejection scenario
    When possible, monitor or simulate a CONNECT request rejection (non-200 response) from the HTTP proxy for non-HTTP(S) URL schemes to confirm the flawed error path is triggered
    Affected if The proxy rejects the CONNECT request with any non-200 status code while handling non-HTTP(S) scheme requests

A system is affected only if curl version is >= 7.77.0 and < 7.86.0 AND an HTTP proxy is configured AND non-HTTP(S) URL schemes (dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, telnet) are accessed through that proxy, with the proxy potentially rejecting the CONNECT request.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 7.86.0 / 12.6.3 / 13.2 or later
Fixed in 7.86.012.6.313.2
Interim mitigation

Upgrade curl to version 7.86.0 or later. As a temporary workaround, avoid using HTTP proxies with non-HTTP(S) URL schemes until the upgrade is applied.

Recommended fix High confidence

curl >= 7.86.0

  1. Identify the current curl version by running `curl --version`
  2. For curl: upgrade to version 7.86.0 or later by obtaining the latest release from https://curl.se/download/ or using your system's package manager
  3. For Fedora systems: run `sudo dnf update curl` to apply vendor patches
  4. For macOS 12.x: update to version 12.6.3 or later via Software Update
  5. For macOS 13.x: update to version 13.2 or later via Software Update
  6. Verify the fix by running `curl --version` and confirming the version is >= 7.86.0
Caveat Major curl upgrades may include behavioral changes; review the curl changelog for any protocol handler or option modifications relevant to your use case

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Curl Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing3.0 h
  • Review / QA2.0 h
17.0 hours of engineering $3,050
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,880.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-42915 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-42915 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data