LiveActive security incident?Get immediate response
CVE Record

CVE-2021-22901: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory be...

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-22901 is a curl/libcurl memory safety flaw affecting versions 7.75.0 through 7.76.1. A malicious TLS server could, in rare conditions, trigger use of freed memory in a curl client and potentially reach remote code execution. No provided source shows active exploitation or KEV listing.

Executive priority

Treat this as targeted high priority where affected curl clients contact untrusted TLS servers. It is not supported as an active exploitation emergency by the provided sources, but potential client remote code execution warrants prompt inventory and upgrade work.

Technical view

The flaw is CWE-416 use-after-free in libcurl’s OpenSSL TLS 1.3 session-ticket handling. Pointers to a transfer object can outlive that object when connections are reused or multiplexed, causing later session-ticket processing to access freed memory and possibly call a stale function pointer.

Likely exposure

Exposure is most likely where applications or appliances embed affected curl/libcurl versions and connect to attacker-controlled or untrusted TLS endpoints. Downstream advisories from Oracle, NetApp, and Siemens indicate the issue affected vendor product ecosystems, but the bundle does not identify every affected product or package build.

Exploitation context

The source bundle describes a malicious server scenario, not a client-side phishing or local attack. Exploitation appears condition-dependent: OpenSSL, TLS 1.3 session tickets, connection reuse or multiplexing, and favorable memory layout. KEV is false, and no cited source here confirms exploitation in the wild.

Researcher notes

Focus validation on libcurl 7.75.0 through 7.76.1 with OpenSSL TLS 1.3 session tickets and reused or multiplexed connections. Avoid assuming exploitability in every deployment; the original description emphasizes rare conditions and memory-shaping uncertainty.

Mitigation direction

  • Identify curl/libcurl versions 7.75.0 through 7.76.1 in applications, containers, and appliances.
  • Upgrade curl/libcurl according to curl and affected vendor advisories.
  • Check Oracle, NetApp, Siemens, and other vendor guidance for embedded product fixes.
  • Prioritize clients that connect to untrusted or user-supplied HTTPS destinations.
  • Document residual exposure where vendor fixes are unavailable or pending.

Validation and detection

  • Inventory runtime curl and libcurl versions, not only package manifests.
  • Confirm whether libcurl is built with OpenSSL and TLS 1.3 support.
  • Review applications that reuse HTTP/1.1 connections or use HTTP/2 multiplexing.
  • Check vendor advisories for affected appliance or bundled software versions.
  • Verify remediation by confirming affected versions are no longer deployed.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-22901 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/ahttps://github.com/curl/curl7.75.0 through 7.76.1Listed
Weakness

CWE details

CWE-416

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-416 · source CWE mapping

Use After Free

Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs