Description
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
References (5)
Scores
CVSS v3
7.5
EPSS
0.0008
EPSS Percentile
22.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-400
CWE-835
Status
published
Products (15)
None/https://github.com/curl/curl
Fixed in 7.83.1
debian/debian_linux
10.0
debian/debian_linux
11.0
haxx/curl
< 7.83.1
netapp/clustered_data_ontap
netapp/h300s_firmware
netapp/h410s_firmware
netapp/h500s_firmware
netapp/h700s_firmware
netapp/hci_bootstrap_os
... and 5 more
Published
Jun 02, 2022
Tracked Since
Feb 18, 2026