CVE-2022-27780 Server-side request forgery in https://github.com/curl/curl

Medium 5.3 Published 1 Jun 2022 Updated 14 Oct 2026

Attackers can bypass URL filters and checks by using percent-encoded separators in hostnames, leading to potential Server-Side Request Forgery.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-27780?

CVE-2022-27780 is a medium-severity server-side request forgery vulnerability in Haxx Curl, published on 1 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

Weakness: CWE-918, CWE-177

Which versions are affected by CVE-2022-27780?

It affects 10 products.

Products include Haxx Curl, Netapp Clustered Data Ontap, Netapp H300s Firmware, Netapp H410s Firmware, Netapp H500s Firmware, Netapp H700s Firmware and 4 more.

How do I fix CVE-2022-27780?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-27780 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-27780 exists.

All Haxx Curl vulnerabilities

Sources

Also known as ALPINE-CVE-2022-27780, AZL-9909, CLEANSTART-2026-TM94388, CURL-CVE-2022-27780, DEBIAN-CVE-2022-27780, GHSA-82rv-h33p-2xgc and 2 more.