CVE-2022-32206

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

• CWE-770
• CWE-770

• http://seclists.org/fulldisclosure/2022/Oct/28Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/02/15/3Mailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfPatch, Third Party Advisory
• https://hackerone.com/reports/1570651Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202212-01Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220915-0003/Third Party Advisory
• https://support.apple.com/kb/HT213488Third Party Advisory
• https://www.debian.org/security/2022/dsa-5197Third Party Advisory
• http://seclists.org/fulldisclosure/2022/Oct/28Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/02/15/3Mailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfPatch, Third Party Advisory
• https://hackerone.com/reports/1570651Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202212-01Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220915-0003/Third Party Advisory
• https://support.apple.com/kb/HT213488Third Party Advisory
• https://www.debian.org/security/2022/dsa-5197Third Party Advisory

Published

Jul 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32200libdwarf 0.4.0 has a heap-based buffer over-read in _dwarf_c…7.8
• CVE-2022-32201In libjpeg 1.63, there is a NULL pointer dereference in Comp…5.5
• CVE-2022-32202In libjpeg 1.63, there is a NULL pointer dereference in Line…5.5
• CVE-2022-32203There is a command injection vulnerability in Huawei termina…9.8
• CVE-2022-32204There is an improper input verification vulnerability in Hua…7.5
• CVE-2022-32205A malicious server can serve excessive amounts of `Set-Cooki…4.3
• CVE-2022-32207When curl < 7.84.0 saves cookies, alt-svc and hsts data to l…9.8
• CVE-2022-32208When curl < 7.84.0 does FTP transfers secured by krb5, it ha…5.9
• CVE-2022-32209# Possible XSS Vulnerability in Rails::Html::SanitizerThere …6.1
• CVE-2022-3221Cross-Site Request Forgery (CSRF) in GitHub repository ikus0…8.8
• CVE-2022-32210`Undici.ProxyAgent` never verifies the remote server's certi…6.5
• CVE-2022-32211A SQL injection vulnerability exists in Rocket.Chat <v3.18.6…8.8