CVE-2022-27775

7.5 HIGH

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the conn...

Published: 2022-06-02 · Last updated: 2026-05-27

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-200

Affected products

Vendor	Product
brocade	clustered_data_ontap, curl, debian_linux
debian	clustered_data_ontap, curl, debian_linux
haxx	clustered_data_ontap, curl, debian_linux
netapp	clustered_data_ontap, curl, debian_linux
splunk	clustered_data_ontap, curl, debian_linux

Description

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2022-27775
[Exploit reference]https://hackerone.com/reports/1546268
[Other]https://security.gentoo.org/glsa/202212-01
[Other]https://security.netapp.com/advisory/ntap-20220609-0008/
[Other]https://www.debian.org/security/2022/dsa-5197
[Exploit reference]https://hackerone.com/reports/1546268
[Other]https://security.gentoo.org/glsa/202212-01
[Other]https://security.netapp.com/advisory/ntap-20220609-0008/
[Other]https://www.debian.org/security/2022/dsa-5197
[Exploit reference]https://hackerone.com/reports/1546268

Related CVEs

Same vendor

CVE-2026-49975 — Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP ... (7.5 HIGH)
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9... (6.5 MEDIUM)
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, ... (7.5 HIGH)
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidentia... (6.5 MEDIUM)
CVE-2026-31431 — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r... (7.8 HIGH)

Same CWE

CVE-2026-49219 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)
CVE-2026-47165 — ImageMagick is free and open-source software used for editing and manipulating digital images (4.1 MEDIUM)
CVE-2026-48855 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery
CVE-2026-45329 — ESF-IDF is the Espressif Internet of Things (IOT) Development Framework (7.1 HIGH)
CVE-2026-36719 — An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain ... (7.5 HIGH)