CVE-2022-32221

What it actually does

libcurl reuses a handle previously configured for PUT with CURLOPT_READFUNCTION and then incorrectly invokes that callback during a subsequent POST that sets CURLOPT_POSTFIELDS, resulting in use-after-free, memory corruption, or transmission of unintended data.

Why it matters to the business

Applications performing repeated HTTP transfers with libcurl may leak sensitive data, crash, or send incorrect payloads, leading to service disruption, data exposure, or failed operations in any software relying on curl for network requests.

How an attack unfolds

An attacker supplies input that causes an application to reuse a single curl handle, first issuing a PUT that registers a read callback and later a POST that supplies POSTFIELDS; libcurl erroneously calls the stale callback, triggering memory corruption or data leakage that the attacker can observe or leverage for further compromise.

How to fix it

Upgrade libcurl to the commit cd95ee9f771361acf241629d2fe5507e308082a2 or later; rebuild and redeploy all dependent applications after updating the library.

How to confirm the fix worked

Confirm the installed libcurl version or commit hash includes cd95ee9f771361acf241629d2fe5507e308082a2; exercise handle reuse from PUT to POST in a test harness and verify that the read callback is no longer invoked for POSTFIELDS requests.

Typical attack path

1. Identify an application that reuses curl handles across request types
2. Trigger a PUT request that sets CURLOPT_READFUNCTION
3. Follow with a POST request that sets CURLOPT_POSTFIELDS on the same handle
4. Observe or induce use-after-free behavior to read or corrupt memory
5. Leverage resulting corruption or leaked data for further attacks

How to detect it

Review application logs for curl-related crashes, segmentation faults, or unexpected memory errors around HTTP POST operations; inspect network traffic for anomalous payload sizes or content after handle-reuse sequences; search process memory dumps for signs of freed callback structures being accessed.

What your security team should do

• Immediately update all curl installations to the fixed commit and rebuild dependent software
• Audit applications for curl handle reuse patterns and replace with fresh handles where possible
• Monitor for memory corruption crashes or anomalous HTTP payload sizes in curl-using services
• Prioritize patching in internet-facing or high-value services given public exploit availability