What’s Vulnerable › Vulnerabilities
CVE-2022-27780
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-06-02 · updated 2026-10-14
- Weakness: CWE-177
Description
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
Affected products
- curl: from 7.80.0 before 7.83.1 — fixed in 7.83.1
- Clustered Data ONTAP: all versions
- NetApp H300S Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Hci Bootstrap Os: all versions
- NetApp Solidfire, Enterprise Sds & Hci Storage Node: all versions
- NetApp Solidfire & Hci Management Node: all versions
- Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6
How to fix
Upgrade to a fixed version: curl 7.83.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.
References
- https://hackerone.com/reports/1553841
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220609-0009/
- https://hackerone.com/reports/1553841
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220609-0009/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Get alerted when CVE-2022-27780 or the next vulnerability affects your stack