curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2022-07-07T00:00:00

Updated: 2024-08-03T07:32:56.021Z

Reserved: 2022-06-01T00:00:00

Link: CVE-2022-32206

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2022-07-07T13:15:08.340

Modified: 2024-03-27T15:00:54.267

Link: CVE-2022-32206

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-06-27T00:00:00Z

Links: CVE-2022-32206 - Bugzilla