← Vulnerability feed

Vulnerability record · CVE-2021-22897 · published 11 June 2021

CVE-2021-22897: Haxx curl exposure of resource to wrong sphere vulnerability

Haxx · Curl

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

5.3 CVSS 3.1 Medium EPSS 3.0% · top 13.2% CWE-840 · CWE-840CWE-668 · Exposure of resource to wrong sphere
5.3CVSS 3.1 base score, v2 4.3
3.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
22Affected product versions listed by NVD
17References, 3 tagged exploit
17 Jun 2026Last modified by NVD

Description

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

22 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
https://curl.se/docs/CVE-2021-22897.html PatchVendor Advisory
https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511 PatchThird Party Advisory
https://hackerone.com/reports/1172857 ExploitIssue TrackingThird Party Advisory
https://security.netapp.com/advisory/ntap-20210727-0007/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
https://curl.se/docs/CVE-2021-22897.html PatchVendor Advisory
https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511 PatchThird Party Advisory
https://hackerone.com/reports/1172857 ExploitIssue TrackingThird Party Advisory
https://security.netapp.com/advisory/ntap-20210727-0007/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
https://hackerone.com/reports/1172857 ExploitIssue TrackingThird Party Advisory

Track CVE-2021-22897 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-54085AMI MegaRAC SPx BMC authentication bypass via Redfish Host InterfaceAMI's SPx BMC implementation contains an authentication bypass reachable remotely through the Redfish Host Interface, classified as CWE-290 (authenti…KEVEPSS 61%analysed9.8CVE-2021-42013Apache HTTP Server path traversal and RCE via incomplete fixThe fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient, leaving a path traversal flaw that lets attackers map URLs to files outside…KEVEPSS 100%analysed9.8CVE-2021-41773Apache HTTP Server 2.4.49 path traversal and RCEA path normalization flaw introduced in Apache HTTP Server 2.4.49 lets attackers map URLs to files outside directories configured by Alias-like direc…KEVEPSS 100%analysed9.0CVE-2021-40438Apache HTTP Server mod_proxy SSRF via crafted URI pathA crafted request URI path can make mod_proxy forward the request to an origin server chosen by the remote user, an SSRF flaw in Apache HTTP Server 2…KEVEPSS 100%analysed8.4CVE-2022-0185Linux Kernel Filesystem Context Heap Buffer OverflowThe legacy_parse_param function in the Linux kernel's Filesystem Context functionality fails to properly verify supplied parameter lengths, causing a…KEVEPSS 25%analysed7.8CVE-2024-1086Linux kernel nf_tables use-after-free allows local privilege escalationThe Linux kernel's netfilter nf_tables component has a use-after-free in nft_verdict_init(), where positive drop errors are accepted and nf_hook_slow…KEVEPSS 28%analysed7.8CVE-2023-4911GNU C Library ld.so GLIBC_TUNABLES heap buffer overflowThe GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds wri…KEVEPSS 81%analysed7.8CVE-2023-0386Linux kernel OverlayFS setuid copy privilege escalationA uid mapping bug in the Linux kernel OverlayFS subsystem lets a local user copy a file with capabilities from a nosuid mount into another mount, byp…KEVEPSS 7.9%analysed

Source: NIST National Vulnerability Database (record CVE-2021-22897), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.