CVE-2022-27781

What it actually does

A malicious TLS server can trigger an infinite busy-loop inside libcurl's NSS certificate-info handling when CURLOPT_CERTINFO is enabled, causing the client to spin at 100 % CPU without making progress.

Why it matters to the business

Applications that use libcurl with NSS and request certificate details can become unresponsive or consume excessive CPU when they connect to an attacker-controlled server, leading to service degradation or outages.

How an attack unfolds

An attacker hosts a TLS server that returns a certificate chain crafted to exercise the faulty NSS code path. A client application built against the vulnerable libcurl, with CURLOPT_CERTINFO enabled, connects to the server; the library enters the busy-loop and never returns, denying service to the calling application.

How to fix it

Upgrade libcurl to a build that contains commit 462196e6b4a47f924293a0e26b8e9c23d37ac26f or later; rebuild any statically linked applications against the patched library.

How to confirm the fix worked

Confirm the running libcurl binary or library reports a version containing commit 462196e6b4a47f924293a0e26b8e9c23d37ac26f; test that connections to servers returning certificate chains complete without spinning.

Typical attack path

1. Attacker deploys a malicious TLS endpoint that supplies a specially formed certificate chain.
2. Victim application using vulnerable libcurl connects to the endpoint with CURLOPT_CERTINFO enabled.
3. libcurl's NSS certificate-info routine enters an infinite loop.
4. Client thread or process is permanently busy, preventing further useful work or causing resource exhaustion.

How to detect it

Look for libcurl worker processes consuming sustained 100 % CPU while performing TLS handshakes; correlate with outbound connections to previously unseen hosts around the time of the spike.

What your security team should do

• Immediately upgrade all curl/libcurl packages to a build containing commit 462196e6b4a47f924293a0e26b8e9c23d37ac26f.
• Audit internal code for use of CURLOPT_CERTINFO and disable the option where it is not required.
• Add the fixed commit identifier to vulnerability scanners and dependency manifests to prevent re-introduction.
• Monitor for high-CPU libcurl worker processes as a temporary compensating control until patching is complete.