CVE-2022-32206

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.84.0

Description The issue concerns the support for "chained" HTTP compression algorithms in curl, where a server response can be compressed multiple times with different algorithms. A malicious server can exploit this by inserting a virtually unlimited number of compression steps, leading to a "malloc bomb" and causing curl to spend enormous amounts of allocated heap memory or return out of memory errors. This can result in a denial of service condition.

Recommendations For versions prior to 7.84.0, update to curl version 7.84.0 to resolve the issue. As a temporary workaround, consider restricting the use of the "chained" HTTP compression algorithms to minimize the risk of exploitation. Avoid connecting to specially-crafted servers that could insert a large number of compression steps.