CVE-2021-22947 - CVE House

Back to Database

Status published Unknown CVE-2021-22947

When curl >= 7.20.0 and <= 7.78.0 connects to an...

0 CVSS

Vulnerability Description

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-22947

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from n/a

View All →

Versions of the package jsondiffpatch before 0.7.2 are vulnerable to...

RemoteClinic profile.php sql injection

Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery

RemoteClinic edit-my-profile.php unrestricted upload

RemoteClinic edit-patient.php information disclosure

Affected Vendor

n/a

View all reports →

Affected Software

https://github.com/curl/curl

Vulnerable Versions:

curl 7.20.0 to and including 7.78.0

Timeline

Official Publish: September 29th, 2021

Last Modified: April 16th, 2026

Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.