CVE-2022-43551

What it actually does

The HSTS mechanism in curl can be bypassed when a hostname in a URL uses IDN characters (such as UTF-8 U+3002) that normalize to ASCII equivalents during conversion; the HSTS state is stored under the IDN form but subsequent lookups use the decoded ASCII form, causing curl to fall back to clear-text HTTP instead of enforcing HTTPS.

Why it matters to the business

Organizations relying on curl for secure data transfers face an elevated risk of sensitive information exposure over unencrypted channels, potentially leading to compliance violations and loss of confidentiality, especially given the widespread use of the library and availability of public exploits despite the issue being over three years old.

How an attack unfolds

An attacker crafts a URL containing an IDN-encoded hostname with a non-ASCII full stop character and supplies it to an application using a vulnerable curl version; curl performs IDN conversion, stores any HSTS entry under the encoded form, fails to match the decoded hostname on the next request, and transmits data in plaintext over HTTP, which can be intercepted.

How to fix it

Upgrade curl to a version containing commit c12fb3ddaf48e709a7a4deaa55ec485e4df163ee (corresponding to curl 7.87.0 or later) across all affected installations and rebuild any dependent applications or packages that statically link curl.

How to confirm the fix worked

Confirm the installed curl binary or library reports version 7.87.0 or newer, or verify the presence of commit c12fb3ddaf48e709a7a4deaa55ec485e4df163ee in the source tree; test with crafted IDN URLs to ensure HSTS enforcement now occurs.

Typical attack path

1. Craft a URL using an IDN hostname with a UTF-8 IDEOGRAPHIC FULL STOP (U+3002) instead of ASCII dot
2. Supply the URL to a client or script that invokes vulnerable curl for the transfer
3. Trigger an initial request so curl stores HSTS state under the IDN-encoded hostname
4. Issue a follow-up request with the equivalent ASCII hostname to bypass HSTS lookup
5. Observe or intercept the resulting clear-text HTTP transfer

How to detect it

Review application logs for curl transfers involving hostnames that contain non-ASCII characters or that unexpectedly use HTTP when HTTPS was expected; examine network traffic for plaintext HTTP requests to domains that should have been protected by HSTS entries.

What your security team should do

• Prioritize patching curl in all environments within standard maintenance windows given the public exploit availability
• Inventory internal and third-party software that embeds or calls curl and schedule upgrades using the exact fixed commit reference
• Update build pipelines and dependency manifests to enforce minimum curl version 7.87.0
• Monitor upstream curl release notes for any related follow-on fixes