Medium
Security advisory
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-22897
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:29 UTC · Revision 1
Source evidence
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
osv:CVE-2021-22897
Complete source record
{
"id": "a47be4291c1f8f3533abb6c537774a82058815cf4182f5cbf06c1c54cc59cf99",
"url": "https://osv.dev/vulnerability/CVE-2021-22897",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-22897",
"summary": "curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single \"static\" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.",
"evidence": "osv:CVE-2021-22897",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-22897",
"aliases": [
"CURL-CVE-2021-22897",
"CVE-2021-22897"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/curl/curl",
"type": "GIT",
"events": [
{
"introduced": "eb8138405a3f747f2c236464932f72e918946f68"
},
{
"last_affected": "566b74a0e19b9aa610f4931e5bfd339bcf8e9147"
},
{
"fixed": "bbb71507b7bab52002f9b1e0880bed6a32834511"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.61.0"
},
{
"last_affected": "7.76.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "bbb71507b7bab52002f9b1e0880bed6a32834511"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"curl-7_76_1",
"curl-7_76_0",
"curl-7_75_0",
"curl-7_74_0",
"curl-7_73_0",
"curl-7_72_0",
"curl-7_71_1",
"curl-7_71_0",
"curl-7_70_0",
"curl-7_69_1",
"curl-7_69_0",
"curl-7_68_0",
"curl-7_67_0",
"curl-7_66_0",
"curl-7_65_3",
"curl-7_65_2",
"curl-7_65_1",
"curl-7_65_0",
"curl-7_64_1",
"curl-7_64_0",
"curl-7_63_0",
"curl-7_62_0",
"curl-7_61_1",
"curl-7_61_0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22897.json",
"vanir_signatures": [
{
"id": "CVE-2021-22897-462e72f1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169306282263403152476778100550579197303",
"297501274346842746936104394958035664195",
"115226342142473284132899468397361420315",
"234734752945961461342272917723384093426",
"295386562829775930098639946838584527244",
"219517661826067509758353138597803787494",
"244949559378790381198359763585636363260",
"332559676467627573058079295969579883439",
"172944519042723511467055631002959388061",
"49891809641561640485570718961026384269",
"303945483550590176791034946765591014847",
"160380589874126636249932610610053765267",
"202261837233141056431919104544500820999"
]
},
"source": "https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511",
"target": {
"file": "lib/vtls/schannel.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-22897-66d13eee",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144288989636727895116566759813531481869",
"310223903940348029157260322620209786472",
"305687057856332765216788005169622682063",
"325657448106323421990448296138158547936",
"292286319081006362423274139499724779986",
"39604824998280807468150180221600407666",
"57176848086045237311152580885468675039"
]
},
"source": "https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511",
"target": {
"file": "lib/vtls/schannel.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-22897-8c49663e",
"digest": {
"length": 14322,
"function_hash": "211186878913764398743821657885986770610"
},
"source": "https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511",
"target": {
"file": "lib/vtls/schannel.c",
"function": "schannel_connect_step1"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-22897-ff708dce",
"digest": {
"length": 676,
"function_hash": "36431407875438539121636832984401189544"
},
"source": "https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511",
"target": {
"file": "lib/vtls/schannel.c",
"function": "set_ssl_ciphers"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:51:04Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/mysql/mysql-server",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "a9b0c712de3509d8d08d3ba385d41a4df6348775"
},
{
"introduced": "270fd3411e3d671a73ed9725940a30080f59ce6d"
},
{
"last_affected": "98b2ccb470de120d36bc4a623c814cdfded958ec"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "5.7.34"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.25"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"mysql-cluster-8.0.25",
"mysql-8.0.25",
"mysql-cluster-8.0.24",
"mysql-8.0.24",
"mysql-5.7.34",
"mysql-5.7.32",
"mysql-5.7.31",
"mysql-5.1.4",
"mysql-4.0.4",
"mysql-4.0.2",
"mysql-3.23.36",
"mysql-3.23.33",
"mysql-3.23.32",
"mysql-3.23.31",
"mysql-3.23.30-gamma",
"mysql-3.23.28-gamma",
"mysql-3.23.22-beta"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22897.json"
}
}
],
"modified": "2026-10-24T14:51:04.912090449Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-389290.html",
"https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"https://security.netapp.com/advisory/ntap-20210727-0007/",
"https://hackerone.com/reports/1172857",
"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"https://curl.se/docs/CVE-2021-22897.html",
"https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:essbase",
"extracted_events": [
{
"range": [
{
"fixed": "11.1.2.4.047"
},
{
"introduced": "21.0"
},
{
"fixed": "21.3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:sinec_infrastructure_network_services",
"extracted_events": [
{
"range": [
{
"fixed": "1.0.1.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*"
],
"vendor_product": "splunk:universal_forwarder",
"extracted_events": [
{
"range": [
{
"introduced": "8.2.0"
},
{
"fixed": "8.2.12"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_binding_support_function",
"extracted_events": [
{
"range": [
{
"introduced": "1.11.0"
},
{
"last_affected": "1.11.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_network_function_cloud_native_environment",
"extracted_events": [
{
"range": [
{
"introduced": "1.10.0"
},
{
"last_affected": "1.10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_network_repository_function",
"extracted_events": [
{
"range": [
{
"introduced": "1.15.0"
},
{
"last_affected": "1.15.0"
},
{
"introduced": "1.15.1"
},
{
"last_affected": "1.15.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_network_slice_selection_function",
"extracted_events": [
{
"range": [
{
"introduced": "1.8.0"
},
{
"last_affected": "1.8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_service_communication_proxy",
"extracted_events": [
{
"range": [
{
"introduced": "1.15.0"
},
{
"last_affected": "1.15.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "splunk:universal_forwarder",
"extracted_events": [
{
"range": [
{
"introduced": "9.1.0"
},
{
"last_affected": "9.1.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-22897",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443857,
"published_at": "2021-06-11T16:15:10.963+00:00"
}