CVE-2021-22947

Exp

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Published: 2021-09-29 Last update: 2026-04-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2021-22947 is rated Exploit Available (55.1/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.25%). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2021-22947

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2021-22947

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-03-04 0.64% 0.25% -0.39%
2 2026-03-01 0.25% 0.64% +0.39%
3 2026-02-20 — 0.25% —

Full EPSS history (46 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2021-22947

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.9 3.1 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 2.2 3.6 [email protected]
5.9 3.1 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 2.2 3.6 134c704f-9b21-4f2e-91b3-4a467353bcc0
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
 8.6 2.9 [email protected]

Weakness enumeration for CVE-2021-22947

OS Trackers for CVE-2021-22947

vendor priority summary link
alpine — CVE-2021-22947: 1 source package rows (curl); 139 state rows across 9 repos (3.11-main, 3.12-main, 3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 9, open 130. https://security.alpinelinux.org/vuln/CVE-2021-22947
debian not yet assigned CVE-2021-22947 not yet assigned priority: Debian including 1 source packages (curl), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2021-22947
gentoo high CVE-2021-22947: 1 GLSA(s) (202212-01), 1 atom(s) (net-misc/curl); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2021-22947
redhat medium — https://access.redhat.com/security/cve/CVE-2021-22947
suse medium CVE-2021-22947 severity moderate: SUSE including 406 source package names (0.1.0:libcurl4-7.60.0-25.1, 0.1.75:libcurl4-7.60.0-25.1, …), 641 product×package rows across 198 product lines (Container bci/bci-init, Container bci/dotnet-aspnet, … (198 product lines)): Fixed 487, Known Affected 154. https://www.suse.com/security/cve/CVE-2021-22947/
ubuntu medium CVE-2021-22947 medium priority: Ubuntu including 1 source packages (curl), 8 status rows across 8 suites (bionic, focal, hirsute, impish, jammy, trusty, upstream, xenial): released 7, needs-triage 1. https://ubuntu.com/security/CVE-2021-22947

Affected software / configurations for CVE-2021-22947

Vendor Product Version Raw CPE
haxx curl >= 7.20.0, < 7.79.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
fedoraproject fedora 33 cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
fedoraproject fedora 35 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
debian debian_linux 9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debian debian_linux 10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debian debian_linux 11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
netapp cloud_backup — cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
netapp clustered_data_ontap — cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
netapp h300s_firmware — cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
netapp h500s_firmware — cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
netapp h700s_firmware — cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
netapp h300e_firmware — cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
netapp h500e_firmware — cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
netapp h700e_firmware — cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
netapp h410s_firmware — cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
netapp solidfire_baseboard_management_controller_firmware — cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
oracle communications_cloud_native_core_binding_support_function 1.11.0 cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_network_function_cloud_native_environment 1.10.0 cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_network_repository_function 1.15.0 cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_network_repository_function 1.15.1 cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*
oracle communications_cloud_native_core_network_slice_selection_function 1.8.0 cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_service_communication_proxy 1.15.0 cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*
oracle mysql_server >= 5.7.0, <= 5.7.35 cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
oracle mysql_server >= 8.0.0, <= 8.0.26 cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.57 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.58 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.59 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
siemens sinec_infrastructure_network_services < 1.0.1.1 cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
apple macos < 12.3 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
oracle commerce_guided_search 11.3.2 cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*
oracle communications_cloud_native_core_binding_support_function 22.1.3 cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
oracle communications_cloud_native_core_console 22.2.0 cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_network_repository_function 22.1.2 cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*
oracle communications_cloud_native_core_network_repository_function 22.2.0 cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_security_edge_protection_proxy 22.1.1 cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*
splunk universal_forwarder >= 8.2.0, < 8.2.12 cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
splunk universal_forwarder >= 9.0.0, < 9.0.6 cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
splunk universal_forwarder 9.1.0 cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References for CVE-2021-22947

URL Tags
http://seclists.org/fulldisclosure/2022/Mar/29 Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch Third Party Advisory
https://hackerone.com/reports/1334763 Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202212-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0003/ Third Party Advisory
https://support.apple.com/kb/HT213183 Release Notes Third Party Advisory
https://www.debian.org/security/2022/dsa-5197 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch Third Party Advisory
cvelogic Threat Intelligence