QwikSec

Security Database

CVE

CWE

Training

CVE-2022-27782

Published: Jun 1, 2022

Modified: May 27, 2026

PUBLISHED

Description

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Vendor	Product	Versions
n/a	https://github.com/curl/curl	affected `Fixed in 7.83.1`

Weaknesses (CWE)

References

https://hackerone.com/reports/1555796

https://security.netapp.com/advisory/ntap-20220609-0009/

vendor-advisory

[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update

mailing-list

vendor-advisory

[oss-security] 20230320 [SECURITY ADVISORY] curl: CVE-2023-27538: SSH connection too eager reuse still

mailing-list

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.