CVE-2021-22901: curl TLS 1.3 session ticket use-after-free in libcurl

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote, unauthenticated memory corruption with potential code execution and a very high EPSS score, though exploitation requires specific connection reuse and timing conditions.

What it is

curl 7.75.0 through 7.76.1 contains a use-after-free in libcurl's TLS 1.3 session ticket handling with OpenSSL. When a connection is reused across transfers (HTTP/1.1 keep-alive or HTTP/2 multiplexing), a stored pointer to a freed transfer object can be dereferenced when a session ticket arrives. The flaw can corrupt memory and, in rare circumstances, allow remote code execution in the client.

Impact

A malicious server can trigger use of freed memory in the connecting client, potentially achieving remote code execution in the context of the application using libcurl. Even without code execution, memory corruption can crash or destabilize the client.

Attack surface

Reached over the network by a malicious or compromised TLS server that the client connects to; no authentication or user interaction is required beyond the client initiating the connection. Exploitation depends on connection reuse and TLS 1.3 session ticket timing, which the CVSS vector reflects as high attack complexity.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.60122 (99.1st percentile) and vendor and HackerOne references are tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade curl/libcurl to a version after 7.76.1 that contains the fix (commit 7f4a9a9b2a49547eae24d2e19bc5c346e9026479).
• Apply vendor patches for products bundling libcurl (Oracle, NetApp, Siemens, Splunk) per their advisories.
• Inventory applications and appliances that embed libcurl and confirm their bundled version.
• If immediate patching is not possible, reduce exposure to untrusted TLS servers and disable or limit TLS 1.3 session ticket reuse where configurable.

Detection

• Monitor for crashes or abnormal termination in processes using libcurl when connecting to external TLS servers.
• Track libcurl/curl versions across hosts and containers to find systems still running 7.75.0 through 7.76.1.
• Review egress connections to untrusted or newly observed TLS servers from applications that use libcurl.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.