CURL-CVE-2022-42915

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2022-42915.html
Import Source
https://curl.se/docs/CURL-CVE-2022-42915.json
JSON Data
https://api.test.osv.dev/v1/vulns/CURL-CVE-2022-42915
Aliases
Published
2022-10-26T08:00:00Z
Modified
2026-05-18T13:46:01.961662Z
Summary
HTTP proxy double free
Details

If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of protocol through.

An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 response code to the client.

Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, telnet

Database specific 
{
    "URL": "https://curl.se/docs/CVE-2022-42915.json",
    "www": "https://curl.se/docs/CVE-2022-42915.html",
    "package": "curl",
    "issue": "https://hackerone.com/reports/1722065",
    "severity": "Medium",
    "CWE": {
        "desc": "Double Free",
        "id": "CWE-415"
    },
    "last_affected": "7.85.0",
    "affects": "both"
}
References
Credits
    • Trail of Bits - FINDER
    • Daniel Stenberg - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
7.77.0
Fixed
7.86.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
51c0ebcff2140c38ff389b4fcfb8216f5e9d198c
Fixed
55e1875729f9d9fc7315cec611bffbd2c817ad89

Affected versions

7.*
7.77.0
7.78.0
7.79.0
7.79.1
7.80.0
7.81.0
7.82.0
7.83.0
7.83.1
7.84.0
7.85.0
Other
curl-7_77_0
curl-7_78_0
curl-7_79_0
curl-7_79_1
curl-7_80_0
curl-7_81_0
curl-7_82_0
curl-7_83_0
curl-7_83_1
curl-7_84_0
curl-7_85_0

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
        "signature_version": "v1",
        "target": {
            "function": "Curl_connect_done",
            "file": "lib/http_proxy.c"
        },
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 527.0,
            "function_hash": "226327460246653662448846497491134006111"
        },
        "id": "CURL-CVE-2022-42915-125b418e"
    },
    {
        "source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
        "signature_version": "v1",
        "target": {
            "file": "lib/http_proxy.c"
        },
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "158114886868495798877842790766691572542",
                "195448685393579191228496467267246686233",
                "246750523063631361536564476188353539776",
                "169418111843831679451902028233861237306",
                "73888404607694589852488371095615032425",
                "99856035058228946158526628147305821260"
            ],
            "threshold": 0.9
        },
        "id": "CURL-CVE-2022-42915-4867a104"
    },
    {
        "source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
        "signature_version": "v1",
        "target": {
            "file": "lib/url.c"
        },
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177451911580205599819902892399272658207",
                "18979437576756851400481743608790032006",
                "112987992078600650018122635257174512225",
                "303360216041138442537420461957947444844",
                "233777828321737175190480280607811020604",
                "291915020736212175739033698376692060999",
                "307551408548938766528468341014658816741",
                "98704575424883992364110184880973667721",
                "234872535971063404315657861979358401871"
            ],
            "threshold": 0.9
        },
        "id": "CURL-CVE-2022-42915-5556bf4b"
    },
    {
        "source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
        "signature_version": "v1",
        "target": {
            "function": "conn_shutdown",
            "file": "lib/url.c"
        },
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 955.0,
            "function_hash": "187535491448722630308343232603697012508"
        },
        "id": "CURL-CVE-2022-42915-6a6ae19d"
    }
]
vanir_signatures_modified 
"2026-05-18T13:46:01Z"
source 
"https://curl.se/docs/CURL-CVE-2022-42915.json"