CVE-2021-22924

LOW

libcurl 7.10.4-7.76.1 - Connection Reuse via Case-Insensitive Path Matching

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-22924. PoCs published by Trinadh465.

AI-analyzed exploit summary The repository contains only build configuration tests (CMake/CurlTests.c) and documentation files, with no actual exploit code or technical analysis related to CVE-2021-22924. The provided code is a series of compile-time checks for system capabilities, not an exploit.

Description

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Exploits (1)

nomisec STUB
by Trinadh465 · poc
https://github.com/Trinadh465/external_curl_AOSP10_r33_CVE-2021-22924

The repository contains only build configuration tests (CMake/CurlTests.c) and documentation files, with no actual exploit code or technical analysis related to CVE-2021-22924. The provided code is a series of compile-time checks for system capabilities, not an exploit.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: N/A
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (15)

Core 15
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1223565
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210902-0003/
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Patch, Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2022/dsa-5197
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html

Scores

CVSS v3 3.7
EPSS 0.0627
EPSS Percentile 92.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-20 CWE-706
Status published
Products (38)
debian/debian_linux 9.0
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 33
haxx/libcurl 7.10.4 - 7.77.0
netapp/cloud_backup
netapp/clustered_data_ontap
netapp/solidfire_\&_hci_management_node
netapp/solidfire_baseboard_management_controller_firmware
oracle/mysql_server 5.7.0 - 5.7.36
... and 28 more
Published Aug 05, 2021
Tracked Since Feb 18, 2026