CVE-2022-32205

Vulnerability

A malicious server can send an excessive number of Set-Cookie headers in an HTTP response. When curl versions prior to 7.84.0 process such a response, they store all received cookies. If the accumulated cookies cause subsequent HTTP requests to exceed curl's internal size threshold of 1048576 bytes, curl returns an error instead of sending the request. This affects all curl versions before 7.84.0 [3].

Exploitation

An attacker must control a server that can respond to HTTP requests with arbitrary headers. The attacker sends a response containing a large number of Set-Cookie headers. Due to cookie matching rules, a server on foo.example.com can set cookies that match bar.example.com, allowing a sister server to trigger a denial of service on other servers within the same second-level domain. The attacker does not require authentication or user interaction beyond the initial request [3].

Impact

Successful exploitation causes a denial of service: legitimate HTTP requests to the affected server (or other matching servers) fail with an error, as long as the excessive cookies remain stored and have not expired. This can disrupt service availability for users of the targeted servers [3].

Mitigation

Upgrade to curl version 7.84.0 or later, which introduces improved cookie handling to prevent this issue. The Gentoo security advisory GLSA 202212-01 recommends upgrading to curl 7.86.0 or later [3]. No workaround is available for unpatched versions.