Unbounded Decompression Chain in curl < 7.84.0
Summary
CVE-2022-32206: curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. Affects curl across 2 version ranges.
< 7.79.1-r2
< 45ac4d019475df03562fe0ac54eb67e1d1de0ca7
Fixed in 7.79.1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The package provides a range of features and options for making HTTP requests and handling responses. However, versions of curl prior to 7.84.0 are vulnerable to an unbounded decompression chain issue.
Vulnerability Detail
The vulnerability in curl < 7.84.0 allows a malicious server to insert an unlimited number of compression steps in the decompression chain. This means that a server response can be compressed multiple times and potentially with different algorithms. As a result, curl may end up consuming excessive amounts of allocated heap memory, leading to a 'malloc bomb' scenario. This can cause curl to exhaust memory resources or return out-of-memory errors.
How To Fix
Minimum fixed version
7.79.1-r2
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of curl as soon as possible.
Conclusion
The unbounded decompression chain vulnerability in curl < 7.84.0 can be mitigated by updating to the latest version of curl. It is important to promptly apply the fix to prevent potential memory exhaustion issues. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols and provides features for making HTTP requests.
An unbounded decompression chain refers to the ability of a server to insert an unlimited number of compression steps in the decompression process.
A 'malloc bomb' occurs when a program consumes excessive amounts of allocated heap memory, leading to resource exhaustion or out-of-memory errors.
To fix this vulnerability, update your curl package to version 7.84.0 or later.
No, there is no known workaround. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
