CVE-2022-35252

🗓️ 23 Sep 2022 00:00:00Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 574 Views

When curl accepts cookies with control codes, it may lead to denial of service vulnerability

Reporter	Title	Published	Views	Family All 204
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Linux Kernel, Golang Go, and cURL libcurl may affect IBM Spectrum Protect Plus	13 Dec 202219:27	–	ibm
IBM Security Bulletins	Security Bulletin: Execution Engine for Apache Hadoop is vulnerable to heap-based buffer overflow and remote attacker to bypass security restrictions	20 Feb 202503:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Golang, Python, postgresql, cURL libcurl might affect IBM Spectrum Copy Data Management	28 Jul 202315:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libcURL affect IBM Rational ClearCase ( CVE-2022-42915, CVE-2022-42916, CVE-2022-32221, CVE-2022-35252, CVE-2022-32205, CVE-2022-32206, CVE-2022-32207 )	31 Jan 202314:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	15 Apr 202502:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	19 Jan 202320:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from curl, go and apr-util	16 Jun 202304:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	12 Apr 202414:33	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL libcurl, PostgreSQL, PyPI cryptography, Node.js can affect IBM Spectrum Protect Plus	20 Jun 202316:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in cURL libcurl (CVE-2022-35252)	27 Jul 202317:27	–	ibm

NVD

Vulners

Node

haxx curlRange<7.85.0

Node

netapp clustered_data_ontapMatch-

netapp element_softwareMatch-

netapp hci_management_nodeMatch-

netapp solidfireMatch-

Node

netapp bootstrap_osMatch-

AND

netapp hci_compute_nodeMatch-

Node

netapp h300s_firmwareMatch-

AND

netapp h300sMatch-

Node

netapp h500s_firmwareMatch-

AND

netapp h500sMatch-

Node

netapp h700s_firmwareMatch-

AND

netapp h700sMatch-

Node

netapp h410s_firmwareMatch-

AND

netapp h410sMatch-

Node

apple macosRange11.0–11.7.3

apple macosRange12.0.0–12.6.3

Node

debian debian_linuxMatch10.0

Node

splunk universal_forwarderRange8.2.0–8.2.12

splunk universal_forwarderRange9.0.0–9.0.6

splunk universal_forwarderMatch9.1.0

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in curl 7.85.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
support	www.support.apple.com/kb/HT213604
hackerone	www.hackerone.com/reports/1613943
seclists	www.seclists.org/fulldisclosure/2023/Jan/20
lists	www.lists.debian.org/debian-lts-announce/2023/01/msg00028.html
security	www.security.gentoo.org/glsa/202212-01
security	www.security.netapp.com/advisory/ntap-20220930-0005/
seclists	www.seclists.org/fulldisclosure/2023/Jan/21
support	www.support.apple.com/kb/HT213603

05 May 2025 17:18Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.13.7

EPSS0.00289

SSVC

CWE-20