ZeroDay Findings
Sign inSign up

Findings

CVE-2022-27776

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but ano…

Published Jun 2, 2022 · updated Oct 14, 2026 · haxx curl

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 2, 2022 · NIST NVD

    Detected

    A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe fedoraproject/fedora36
  • cpe fedoraproject/fedora37
  • cpe haxx/curlversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h410s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe netapp/hci bootstrap osversion unspecified
  • cpe netapp/solidfire & hci management nodeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2022-27776

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-27776

    30-day exploitation probability 4.1%

    first.org
  • NIST NVDVulnerability recordCVE-2022-27776

    A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

    nvd.nist.gov

References