What’s Vulnerable › Vulnerabilities

CVE-2022-32206

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 36.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-07 · updated 2026-10-14
• Weakness: CWE-770

Description

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

Affected products

• Debian Linux: 10.0, 11.0
• Fedoraproject Fedora: 35
• curl: before 7.84.0 — fixed in 7.84.0
• NetApp Bootstrap Os: all versions
• Clustered Data ONTAP: all versions
• NetApp Element Software: all versions
• NetApp H300S Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions
• Siemens Scalance Sc622-2C Firmware: before 3.0 — fixed in 3.0
• Siemens Scalance Sc626-2C Firmware: before 3.0 — fixed in 3.0
• Siemens Scalance Sc632-2C Firmware: before 3.0 — fixed in 3.0
• Siemens Scalance Sc636-2C Firmware: before 3.0 — fixed in 3.0
• Siemens Scalance Sc642-2C Firmware: before 3.0 — fixed in 3.0
• Siemens Scalance Sc646-2C Firmware: before 3.0 — fixed in 3.0
• Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: curl 7.84.0; Siemens Scalance Sc622-2C Firmware 3.0; Siemens Scalance Sc626-2C Firmware 3.0; Siemens Scalance Sc632-2C Firmware 3.0; Siemens Scalance Sc636-2C Firmware 3.0; Siemens Scalance Sc642-2C Firmware 3.0; Siemens Scalance Sc646-2C Firmware 3.0; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/41
• http://www.openwall.com/lists/oss-security/2023/02/15/3
• https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
• https://hackerone.com/reports/1570651
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220915-0003/
• https://support.apple.com/kb/HT213488
• https://www.debian.org/security/2022/dsa-5197
• http://seclists.org/fulldisclosure/2022/Oct/28

Get alerted when CVE-2022-32206 or the next vulnerability affects your stack