CVE-2022-35260
curl can be told to parse a file for credentials.
Published Dec 5, 2022 · updated Oct 14, 2026 · haxx curl
curl can be told to parse a file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.
Timeline
Detection, updates, and resolution for this record.
Dec 5, 2022 · NIST NVD
Detected
curl can be told to parse a file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a
Oct 14, 2026 · NIST NVD
Updated
curl can be told to parse a file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a
Affected
- cpe apple/macosversion unspecified
- cpe haxx/curlversion unspecified
- cpe netapp/clustered data ontapversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h410s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/h700s firmwareversion unspecified
- cpe splunk/universal forwarderversion unspecified
Sources
- CVE.orgCVE-2022-35260
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-35260
30-day exploitation probability 1.9%
first.org - NIST NVDCVE-2022-35260
curl can be told to parse a file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will i
nvd.nist.gov