CVE-2022-42916

What it actually does

The HSTS enforcement logic in curl fails to normalize IDN hostnames before comparison, allowing a Unicode full stop (U+3002) to bypass the stored HTTPS policy and downgrade a request to cleartext HTTP.

Why it matters to the business

Organizations relying on curl for secure transfers face increased risk of credential or data exposure over unencrypted channels when connecting to domains that use internationalized names, especially in automated scripts and CI/CD pipelines that still run older builds.

How an attack unfolds

An attacker registers or controls a domain whose IDN form contains a visually similar full-width stop, tricks a curl client into requesting that host via HTTP, and the HSTS check is evaded because the converted ASCII form does not match the previously stored HTTPS entry, resulting in an unencrypted connection.

How to fix it

Upgrade curl to version 7.86.0 or later, or apply commit cd95ee9f771361acf241629d2fe5507e308082a2. Rebuild any statically linked binaries and verify the new version reports itself as 7.86.0 or newer.

How to confirm the fix worked

Run 'curl --version' and confirm the reported version is 7.86.0 or later; test HSTS behavior with a crafted IDN URL containing U+3002 to ensure HTTPS is enforced.

Typical attack path

1. Attacker crafts a URL containing an IDN hostname with U+3002 instead of '.'
2. Victim client using curl < 7.86.0 resolves the name and performs an HSTS lookup on the unconverted form
3. No matching HTTPS entry is found, so curl proceeds with plain HTTP
4. Attacker intercepts or observes the cleartext traffic to capture sensitive data

How to detect it

Search proxy, web server, and endpoint logs for HTTP requests to hosts whose names contain or resolve from IDN full-width stops; review curl command lines or library calls that lack explicit --proto-redir or --hsts options.

What your security team should do

• Immediately inventory all systems and containers using curl < 7.86.0
• Prioritize patching of internet-facing automation, proxies, and download scripts
• Add curl version checks to build pipelines and dependency scanners
• Monitor EPSS trend and re-evaluate if exploit code appears