CVE-2022-32221 Use after free in https://github.com/curl/curl

Critical 9.8 Published 5 Dec 2022 Updated 14 Oct 2026

A use-after-free flaw in libcurl allows attackers to cause memory corruption or information disclosure when reusing handles for POST requests after PUT.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-32221?

CVE-2022-32221 is a critical use after free vulnerability in Apple Macos, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Weakness: CWE-668, CWE-200

Which versions are affected by CVE-2022-32221?

It affects 9 products.

Linux distribution packages (40)

`curl` AlmaLinux:9	All versions	`7.76.1-19.el9_1.1`
`curl-minimal` AlmaLinux:9	All versions	`7.76.1-19.el9_1.1`
`libcurl` AlmaLinux:9	All versions	`7.76.1-19.el9_1.1`
`libcurl-devel` AlmaLinux:9	All versions	`7.76.1-19.el9_1.1`
`libcurl-minimal` AlmaLinux:9	All versions	`7.76.1-19.el9_1.1`
`curl-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-19.el9_1.1`
`curl-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-19.el9_1.1`
`curl-minimal-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-19.el9_1.1`
`libcurl-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-19.el9_1.1`
`libcurl-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-19.el9_1.1`
`libcurl-minimal-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:7.76.1-19.el9_1.1`
`curl` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`curl-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`curl-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`curl-minimal` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`curl-minimal-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`libcurl` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`libcurl-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`libcurl-minimal` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`libcurl-minimal-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:7.76.1-19.el9_1.1`
`curl` Rocky Linux:9	All versions	`0:7.76.1-19.el9_1.1`
`curl` SUSE:Enterprise Storage 7	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise Micro 5.1	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise Micro 5.2	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`7.37.0-37.85.1`
`curl` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`7.37.0-37.85.1`
`curl` SUSE:Linux Enterprise Server 12 SP5	All versions	`7.60.0-11.49.1`
`curl` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`7.60.0-11.49.1`
`curl` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`7.60.0-11.49.1`
`curl` SUSE:Manager Proxy 4.1	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Manager Retail Branch Server 4.1	All versions	`7.66.0-150200.4.42.1`
`curl` SUSE:Manager Server 4.1	All versions	`7.66.0-150200.4.42.1`
`curl` openSUSE:Leap 15.3	All versions	`7.66.0-150200.4.42.1`
`curl` openSUSE:Leap Micro 5.2	All versions	`7.66.0-150200.4.42.1`

Products include Apple Macos, Debian Debian Linux, Haxx Curl, Netapp Clustered Data Ontap, Netapp H300s Firmware, Netapp H410s Firmware and 3 more.

How do I fix CVE-2022-32221?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-32221 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-32221 exists.

All Apple Macos vulnerabilities

Sources

Also known as ALPINE-CVE-2022-32221, ALSA-2023:0333, AZL-38548, CLEANSTART-2026-JF72424, CLSA-2022-1667515188, CLSA-2022-1671123782 and 19 more.