CVE-2021-22901
Highcurl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.
Published May 13, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2021-22901, CURL-CVE-2021-22901, TR-22-0351, UBUNTU-CVE-2021-22901
Key Facts
Patch immediately- CVE-2021-22901 is a high-severity vulnerability (CVSS 8.1 v3.1) affecting Curl (Haxx), Active Iq Unified Manager (Netapp), Cloud Backup (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 64% probability of exploitation in the next 30 days.
- Fixed versions are available, including Curl 7.75.0-2.ph1, Curl 7.75.0-2.ph2, Curl 7.75.0-2.ph3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
64%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-22901 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.
Affected Products
95 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| CurlHaxx | See advisory | 7.76.1 |
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| Cloud BackupNetapp | See advisory | n/a |
| Oncommand InsightNetapp | See advisory | n/a |
| Oncommand Workflow AutomationNetapp | See advisory | n/a |
Patched Releases
Curl
7.75.0-2.ph1, 7.75.0-2.ph2, 7.75.0-2.ph3, 7.75.0-2.ph4, 7.76.0-2, 7.76.0-5, 7.77.0-1, 7.77.0-r0, 7.79.1-1.1, <=7.76.1
curl-devel
7.75.0-2.ph4
curl-libs
7.75.0-2.ph4
jbcs-httpd24
0:1-18.el8jbcs, 0:1-18.jbcs.el7
jbcs-httpd24-apr
0:1.6.3-105.el8jbcs, 0:1.6.3-105.jbcs.el7
jbcs-httpd24-apr-util
0:1.6.1-82.el8jbcs, 0:1.6.1-82.jbcs.el7
jbcs-httpd24-brotli
0:1.0.6-40.el8jbcs
jbcs-httpd24-curl
0:7.77.0-2.el8jbcs, 0:7.77.0-2.jbcs.el7
jbcs-httpd24-httpd
0:2.4.37-74.el8jbcs, 0:2.4.37-74.jbcs.el7
jbcs-httpd24-jansson
0:2.11-55.el8jbcs, 0:2.11-55.jbcs.el7
jbcs-httpd24-mod_cluster-native
0:1.3.16-5.Final_redhat_2.el8jbcs, 0:1.3.16-5.Final_redhat_2.jbcs.el7
jbcs-httpd24-mod_http2
0:1.15.7-17.el8jbcs, 0:1.15.7-17.jbcs.el7
jbcs-httpd24-mod_jk
0:1.2.48-16.redhat_1.el8jbcs, 0:1.2.48-16.redhat_1.jbcs.el7
jbcs-httpd24-mod_md
1:2.0.8-36.el8jbcs, 1:2.0.8-36.jbcs.el7
jbcs-httpd24-mod_security
0:2.9.2-63.GA.el8jbcs, 0:2.9.2-63.GA.jbcs.el7
jbcs-httpd24-nghttp2
0:1.39.2-37.el8jbcs
jbcs-httpd24-openssl
1:1.1.1g-6.el8jbcs
jbcs-httpd24-openssl-chil
0:1.0.0-5.el8jbcs
jbcs-httpd24-openssl-pkcs11
0:0.4.10-20.el8jbcs
lib32-curl
7.77.0-1
lib32-libcurl-compat
7.77.0-1
libcurl-compat
7.77.0-1
libcurl-devel
7.79.1-1.1
libcurl-devel-32bit
7.79.1-1.1
libcurl4
7.79.1-1.1
Timeline
Publicly disclosed
May 13, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryRHSA-2021:2471
- advisoryRHSA-2021:2472
- advisoryhttps://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf
- advisoryhttps://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
- advisoryhttps://security.alpinelinux.org/vuln/CVE-2021-22901
FAQ
Common Questions.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.
Affected: Curl (Haxx); Active Iq Unified Manager (Netapp); Cloud Backup (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Curl 7.75.0-2.ph1, Curl 7.75.0-2.ph2, Curl 7.75.0-2.ph3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-22901 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo