CVE-2021-22890 Security feature bypass in https://github.com/curl/curl
A malicious HTTPS proxy can bypass TLS certificate checks in libcurl via session ticket confusion, enabling Man-in-the-Middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-22890?
CVE-2021-22890 is a medium-severity vulnerability in Broadcom Fabric Operating System, published on 1 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.
Which versions are affected by CVE-2021-22890?
It affects 11 products.
Products include Broadcom Fabric Operating System, Debian Debian Linux, Fedoraproject Fedora, Haxx Libcurl, Netapp Hci Management Node, Netapp Hci Storage Node and 5 more.
How do I fix CVE-2021-22890?
Upgrade to a fixed version.
Is CVE-2021-22890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22890 exists.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as ALPINE-CVE-2021-22890, CLEANSTART-2026-FP47166, CURL-CVE-2021-22890, DEBIAN-CVE-2021-22890, GHSA-5cwr-528x-3vwc, JLSEC-2025-27 and 1 more.