CVE-2022-42916

7.5 HIGH
Published: October 29, 2022 Modified: February 13, 2026
View on NVD

Description

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/19
Source: cve@mitre.org
Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/20
Source: cve@mitre.org
Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/12/21/1
Source: cve@mitre.org
Mailing List Third Party Advisory
https://curl.se/docs/CVE-2022-42916.html
Source: cve@mitre.org
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
Source: cve@mitre.org
Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
Source: cve@mitre.org
Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
Source: cve@mitre.org
Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202212-01
Source: cve@mitre.org
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0010/
Source: cve@mitre.org
Broken Link
https://support.apple.com/kb/HT213604
Source: cve@mitre.org
Third Party Advisory
https://support.apple.com/kb/HT213605
Source: cve@mitre.org
Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/19
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jan/20
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/12/21/1
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://curl.se/docs/CVE-2022-42916.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202212-01
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0010/
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
https://support.apple.com/kb/HT213604
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://support.apple.com/kb/HT213605
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

22 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
0.1%
31th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-319 CWE-319

Affected Vendors

fedoraproject haxx apple splunk

Related CVEs

CVE-2019-25589 6.2
CVE-2019-25588 6.2
CVE-2019-25587 6.2
CVE-2019-25586 6.2
CVE-2019-25585 6.2