When doing HTTP(S) transfers libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send even when the `CURLOPT_POSTFIELDS` option has been set if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

🗓️ 30 Jun 2024 14:00:00Reported by MicrosoftType

libcurl may reuse a PUT handle for POST with POSTFIELDS, triggering read callback and data errors.

Reporter	Title	Published	Views	Family All 347
FreeBSD	curl -- multiple vulnerabilities	26 Oct 202200:00	–	freebsd
FreeBSD	MySQL -- Multiple vulnerabilities	20 Jan 202300:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Execution Engine for Apache Hadoop is vulnerable to heap-based buffer overflow and remote attacker to bypass security restrictions	20 Feb 202503:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libcURL affect IBM Rational ClearCase ( CVE-2022-42915, CVE-2022-42916, CVE-2022-32221, CVE-2022-35252, CVE-2022-32205, CVE-2022-32206, CVE-2022-32207 )	31 Jan 202314:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	14 Mar 202316:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in libcurl (CVE-2022-32221)	17 May 202322:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data are addressed	3 Mar 202514:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboard operands are vulnerable to security restrictions bypass due to [CVE-2022-32221], [CVE-2023-27533], [CVE-2023-28322]	20 Jul 202315:15	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to security restrictions bypass due to curl (CVE-2022-32221)	26 May 202316:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	15 Apr 202502:31	–	ibm