CVE-2022-42915
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
Key facts
- CVSS score
- 8.1 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-415
- EPSS score
- 2.9% (87th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2022-45972)
- Published
- October 29, 2022
- NVD last modified
- October 14, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2022-45972 in the EU Vulnerability Database. Last updated in EUVD on October 14, 2026.
View on the EU Vulnerability DatabaseAffected products
- apple / macos
- fedoraproject / fedora
- fedoraproject / fedora
- fedoraproject / fedora
- haxx / curl
- netapp / h300s
- netapp / h300s firmware
- netapp / h410s
- netapp / h410s firmware
- netapp / h500s
- netapp / h500s firmware
- netapp / h700s
- netapp / h700s firmware
- netapp / ontap 9
- splunk / universal forwarder
- splunk / universal forwarder
Certified products that may be affected
8 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- NetApp Volume Encryption (NVE) Appliances running ONTAP 9.14.1 - NetApp, Inc. - Common Criteria CCEVS-VR-VID-11475-2024 - active
- NetApp Storage Encryption (NSE) Running ONTAP 9.14.1 - NetApp, Inc. - Common Criteria CCEVS-VR-VID-11477-2024 - active
- Strong Customer Authentication pour Apple Pay sur Mac mini avec M1 et Magic keyboard avec Touch ID, exécutant macOS Monterey 12.3.1 (Version 12.3.1 (build 21E258)) - Apple Inc. - Common Criteria ANSSI-CC-2023/19 - active
- Strong Customer Authentication pour Apple Pay sur MacBook Air 2020 avec M1 exécutant macOS Monterey 12.3.1 (Version 12.3.1 (build 21E258)) - Apple Inc. - Common Criteria ANSSI-CC-2023/16 - active
- Apple macOS 13 Ventura - Apple Inc. - Common Criteria CCEVS-VR-VID-11347-2024 - archived
See all 8 in the Security Certifications Explorer.
References
- http://seclists.org/fulldisclosure/2023/Jan/19(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Jan/20(Mailing List, Third Party Advisory)
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-892048.html
- https://curl.se/docs/CVE-2022-42915.html(Vendor Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/(Mailing List, Third Party Advisory)
- https://security.gentoo.org/glsa/202212-01(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20221209-0010/(Third Party Advisory)
- https://support.apple.com/kb/HT213604(Third Party Advisory)
- https://support.apple.com/kb/HT213605(Third Party Advisory)
Last updated October 15, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain