HTTP proxy double free
If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a `CONNECT` request to the proxy, and then *tunnels* the rest of protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 response code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: `dict`, `gopher`, `gophers`, `ldap`, `ldaps`, `rtmp`, `rtmps`, `telnet`
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-42915
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:39 UTC · Revision 1
Source evidence
If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a `CONNECT` request to the proxy, and then *tunnels* the rest of protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 response code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: `dict`, `gopher`, `gophers`, `ldap`, `ldaps`, `rtmp`, `rtmps`, `telnet`
osv:CURL-CVE-2022-42915
Complete source record
{
"id": "f8372c989d1f5b2073ca5c0a5f229a016a46a429d30b4950c1b517c0bd48a88b",
"url": "https://osv.dev/vulnerability/CURL-CVE-2022-42915",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "HTTP proxy double free",
"summary": "If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a `CONNECT` request to the proxy, and then *tunnels* the rest of protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 response code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: `dict`, `gopher`, `gophers`, `ldap`, `ldaps`, `rtmp`, `rtmps`, `telnet`",
"evidence": "osv:CURL-CVE-2022-42915",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2022-42915",
"aliases": [
"CURL-CVE-2022-42915",
"CVE-2022-42915"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.77.0"
},
{
"fixed": "7.86.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "51c0ebcff2140c38ff389b4fcfb8216f5e9d198c"
},
{
"fixed": "55e1875729f9d9fc7315cec611bffbd2c817ad89"
}
]
}
],
"versions": [
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"curl-7_85_0",
"curl-7_84_0",
"curl-7_83_1",
"curl-7_83_0",
"curl-7_82_0",
"curl-7_81_0",
"curl-7_80_0",
"curl-7_79_1",
"curl-7_79_0",
"curl-7_78_0",
"curl-7_77_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2022-42915.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2022-42915-125b418e",
"digest": {
"length": 527,
"function_hash": "226327460246653662448846497491134006111"
},
"source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
"target": {
"file": "lib/http_proxy.c",
"function": "Curl_connect_done"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-42915-4867a104",
"digest": {
"threshold": 0.9,
"line_hashes": [
"158114886868495798877842790766691572542",
"195448685393579191228496467267246686233",
"246750523063631361536564476188353539776",
"169418111843831679451902028233861237306",
"73888404607694589852488371095615032425",
"99856035058228946158526628147305821260"
]
},
"source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
"target": {
"file": "lib/http_proxy.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-42915-5556bf4b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"177451911580205599819902892399272658207",
"18979437576756851400481743608790032006",
"112987992078600650018122635257174512225",
"303360216041138442537420461957947444844",
"233777828321737175190480280607811020604",
"291915020736212175739033698376692060999",
"307551408548938766528468341014658816741",
"98704575424883992364110184880973667721",
"234872535971063404315657861979358401871"
]
},
"source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
"target": {
"file": "lib/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-42915-6a6ae19d",
"digest": {
"length": 955,
"function_hash": "187535491448722630308343232603697012508"
},
"source": "https://github.com/curl/curl.git/commit/55e1875729f9d9fc7315cec611bffbd2c817ad89",
"target": {
"file": "lib/url.c",
"function": "conn_shutdown"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:05:33Z"
}
}
],
"modified": "2026-10-25T01:05:33.321953193Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-415",
"desc": "Double Free"
},
"URL": "https://curl.se/docs/CVE-2022-42915.json",
"www": "https://curl.se/docs/CVE-2022-42915.html",
"issue": "https://hackerone.com/reports/1722065",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "7.85.0"
}
},
"related_cves": [
{
"value": "CVE-2022-42915",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444401,
"published_at": "2022-10-26T08:00:00+00:00"
}