CVE-2022-27775

What it actually does

The vulnerability permits reuse of a pooled IPv6 connection when the target address matches but the zone identifier differs, allowing cross-connection data leakage from prior sessions.

Why it matters to the business

Organizations face exposure of sensitive response data across dependent libraries and applications, amplified by 331 downstream dependents and the availability of public exploits nearly four years after publication.

How an attack unfolds

An attacker with network access supplies IPv6 addresses differing only in zone ID to trigger improper connection reuse from the pool, capturing responses intended for another context; named threat actors and public exploits have demonstrated this vector against affected curl versions.

How to fix it

Upgrade all affected curl installations and dependent packages; for pillow (Bitnami) deployments move to version 9.0.0 or later that incorporates corrected libcurl behavior.

How to confirm the fix worked

Verify curl version strings and package manifests show upgrades beyond 7.82.0; test connection pooling behavior with IPv6 zone-ID variants to confirm isolation; review build logs for the fixed pillow 9.0.0 dependency.

Typical attack path

1. Scan for services using curl 7.65.0-7.82.0 or downstream packages such as affected pillow builds
2. Craft requests containing IPv6 literals with alternate zone IDs that match pooled connection keys
3. Force the client to select the reused connection instead of establishing a fresh one
4. Observe or capture response data belonging to the prior connection context

How to detect it

Review application and curl debug logs for repeated IPv6 connection reuse events, mismatched zone-ID handling, or unexpected cross-request data leakage; examine proxy or client logs for patterns of IPv6 literals with zone suffixes.

What your security team should do

• Immediately inventory all systems for curl 7.65.0-7.82.0 and pillow (Bitnami) instances
• Prioritize upgrades to pillow (Bitnami) 9.0.0 and equivalent curl patches across the environment
• Monitor EPSS trend and exploit availability for any remaining unpatched assets
• Implement network segmentation and connection-pool logging until remediation completes