CVE-2021-22925
curl supports the command line option, known as in libcurl.
Published Aug 5, 2021 · updated Oct 14, 2026 · haxx curl
curl supports the command line option, known as in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Aug 5, 2021 · NIST NVD
Detected
curl supports the command line option, known as in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.T
Oct 14, 2026 · NIST NVD
Updated
curl supports the command line option, known as in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.T
Affected
- cpe apple/mac os x10.15.7
- cpe fedoraproject/fedora33
- cpe haxx/curlversion unspecified
- cpe netapp/cloud backupversion unspecified
- cpe netapp/clustered data ontapversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/hci management nodeversion unspecified
- cpe netapp/solidfireversion unspecified
- cpe oracle/mysql serverversion unspecified
- cpe siemens/sinec infrastructure network servicesversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2021-22925
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-22925
30-day exploitation probability 5.4%
first.org - NIST NVDVulnerability recordCVE-2021-22925
curl supports the command line option, known as in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending variables, libcurlcould be made to pass on uninitialized
nvd.nist.gov