CVE-2022-32206

Description

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

How to fix CVE-2022-32206

To remediate CVE-2022-32206, upgrade the affected package to a fixed version below.

• —upgrade to 7.79.1-r2 or later
• —upgrade to 7.74.0-1.3+deb11u2 or later

Is CVE-2022-32206 being exploited?

Low — EPSS is 3.4%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 7.79.1-r2
• from 0, < 7.74.0-1.3+deb11u2

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2022-32206
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-32206