CVE-2022-35252

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-23 · updated 2026-10-14
Weakness: CWE-20

Description

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Affected products

Apple macOS: from 11.0 before 11.7.3; from 12.0.0 before 12.6.3 — fixed in 11.7.3, 12.6.3
Debian Linux: 10.0
curl: before 7.85.0 — fixed in 7.85.0
NetApp Bootstrap Os: all versions
Clustered Data ONTAP: all versions
NetApp Element Software: all versions
NetApp H300S Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Hci Management Node: all versions
NetApp Solidfire: all versions
Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: Apple macOS 11.7.3, 12.6.3; curl 7.85.0; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-35252 or the next vulnerability affects your stack