CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

• CWE-300
• CWE-290

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://curl.se/docs/CVE-2021-22890.htmlPatch, Vendor Advisory
• https://hackerone.com/reports/1129529Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202105-36Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210521-0007/Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://curl.se/docs/CVE-2021-22890.htmlPatch, Vendor Advisory
• https://hackerone.com/reports/1129529Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202105-36Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210521-0007/Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory

Published

Apr 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22885A possible information disclosure / unintended method execut…7.5
• CVE-2021-22886Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable …6.1
• CVE-2021-22887A vulnerability in the BIOS of Pulse Secure (PSA-Series Hard…2.3
• CVE-2021-22888Revive Adserver before v5.2.0 is vulnerable to a reflected X…6.1
• CVE-2021-22889Revive Adserver before v5.2.0 is vulnerable to a reflected X…6.1
• CVE-2021-2289Vulnerability in the Oracle Product Hub product of Oracle E-…8.1
• CVE-2021-22891A missing authorization vulnerability exists in Citrix Share…9.8
• CVE-2021-22892An information disclosure vulnerability exists in the Rocket…7.5
• CVE-2021-22893Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to…10
• CVE-2021-22894A buffer overflow vulnerability exists in Pulse Connect Secu…8.8
• CVE-2021-22895Nextcloud Desktop Client before 3.3.1 is vulnerable to impro…5.9
• CVE-2021-22896Nextcloud Mail before 1.9.5 suffers from improper access con…4.3