CVE-2022-42916
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.
Timeline
ID reserved
By mitre
- 16 days later
· 16 days later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.5% · top 15% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
n/a
- affected n/a
References (13)
- https://curl.se/docs/CVE-2022-42916.html (opens in a new tab)x_transferred
- FEDORA-2022-01ffde372c (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-39688a779d (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-e9d65906c4 (opens in a new tab)vendor-advisoryx_transferred
- https://security.netapp.com/advisory/ntap-20221209-0010/ (opens in a new tab)x_transferred
- GLSA-202212-01 (opens in a new tab)vendor-advisoryx_transferred
- [oss-security] 20221221 curl: CVE-2022-43551: Another HSTS bypass via IDN (opens in a new tab)mailing-listx_transferred
- https://support.apple.com/kb/HT213604 (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT213605 (opens in a new tab)x_transferred
- 20230123 APPLE-SA-2023-01-23-5 macOS Monterey 12.6.3 (opens in a new tab)mailing-listx_transferred
- 20230123 APPLE-SA-2023-01-23-4 macOS Ventura 13.2 (opens in a new tab)mailing-listx_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-892048.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-42916)Record last updated .