ZeroDay Findings
Sign inSign up

Findings

CVE-2022-27780

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host n…

Published Jun 2, 2022 · updated Oct 14, 2026 · haxx curl

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like , would be allowed bythe parser and get transposed into . This flawcan be used to circumvent filters, checks and more.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 2, 2022 · NIST NVD

    Detected

    The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like , would be allowed bythe parser and get transposed into . This flawcan be used to circumvent filters, checks and more.

  2. Oct 14, 2026 · NIST NVD

    Updated

    The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like , would be allowed bythe parser and get transposed into . This flawcan be used to circumvent filters, checks and more.

Affected

  • cpe haxx/curlversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h410s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe netapp/hci bootstrap osversion unspecified
  • cpe netapp/solidfire & hci management nodeversion unspecified
  • cpe netapp/solidfire, enterprise sds & hci storage nodeversion unspecified
  • cpe splunk/universal forwarderversion unspecified

Sources

  • CVE.orgCVE-2022-27780

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-27780

    30-day exploitation probability 2.5%

    first.org
  • NIST NVDCVE-2022-27780

    The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like , would be allowed bythe

    nvd.nist.gov

References