VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 5, 2021· Updated Jun 9, 2025

CVE-2021-22924

CVE-2021-22924

Description

libcurl's connection reuse logic fails to compare issuer_cert and case-sensitive paths, potentially reusing wrong connections.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

libcurl's connection reuse logic fails to compare issuer_cert and case-sensitive paths, potentially reusing wrong connections.

Vulnerability

libcurl maintains a connection pool for reuse. The config matching function used to compare paths case-insensitively and did not consider the 'issuer_cert' setting. This leads to potential reuse of connections that do not match the intended security context, allowing for cross-connection misuse. Affected versions include libcurl prior to the fix in version 7.77.0 [1].

Exploitation

An attacker who can control file paths (e.g., via environment variables or configuration) or set the issuer_cert option may cause libcurl to match an existing connection incorrectly. No authentication is required, but the attacker must influence the connection setup parameters. The flaw can be triggered without user interaction if the application uses connection reuse with these settings.

Impact

Successful exploitation can result in reusing a connection that was established for a different server or with different security requirements. This could lead to information disclosure (e.g., sending data to an unintended server), authentication bypass, or credential leakage. The attacker may gain unintended access to resources or perform actions in the context of the misdirected connection.

Mitigation

The vulnerability is fixed in libcurl version 7.77.0 released on 2021-07-21. Users should upgrade to this version or later. If upgrade is not possible, avoid using the 'issuer_cert' option with case-sensitive paths, or disable connection reuse. There is no known workaround beyond patching. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

References
  1. lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

29

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

15

News mentions

0

No linked articles in our index yet.