Medium
HTTP compression denial of service
Type: advisorySources: OSV
curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-32206
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:38 UTC · Revision 1
Source evidence
curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
osv:CURL-CVE-2022-32206
Complete source record
{
"id": "b19fb08e98ab645f457648ed54d04ca7f01ca05099dec5b04b398650b22c6905",
"url": "https://osv.dev/vulnerability/CURL-CVE-2022-32206",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "HTTP compression denial of service",
"summary": "curl supports \"chained\" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps. The use of such a decompression chain could result in a \"malloc bomb\", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.",
"evidence": "osv:CURL-CVE-2022-32206",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2022-32206",
"aliases": [
"CURL-CVE-2022-32206",
"CVE-2022-32206"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.57.0"
},
{
"fixed": "7.84.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "dbcced8e32b50c068ac297106f0502ee200a1ebd"
},
{
"fixed": "3a09fbb7f264c67c438d01a30669ce325aa508e2"
}
]
}
],
"versions": [
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"curl-7_83_1",
"curl-7_83_0",
"curl-7_82_0",
"curl-7_81_0",
"curl-7_80_0",
"curl-7_79_1",
"curl-7_79_0",
"curl-7_78_0",
"curl-7_77_0",
"curl-7_76_1",
"curl-7_76_0",
"curl-7_75_0",
"curl-7_74_0",
"curl-7_73_0",
"tiny-curl-7_72_0",
"curl-7_72_0",
"curl-7_71_1",
"curl-7_71_0",
"curl-7_70_0",
"curl-7_69_1",
"curl-7_69_0",
"curl-7_68_0",
"curl-7_67_0",
"curl-7_66_0",
"curl-7_65_3",
"curl-7_65_2",
"curl-7_65_1",
"curl-7_65_0",
"curl-7_64_1",
"curl-7_64_0",
"curl-7_63_0",
"curl-7_62_0",
"curl-7_61_1",
"curl-7_61_0",
"curl-7_60_0",
"curl-7_59_0",
"curl-7_58_0",
"curl-7_57_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2022-32206.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2022-32206-2afb59a3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45157733837481580733201877978631346553",
"289994305010963280595464022725692321783",
"285418258574578001939871387444273795700",
"36972230101229254421458880172651761630",
"258485294902386500308213611257281103675",
"223508019877366983451146801494110424292",
"111336570175832252860899159343638748825",
"306740132958412367269024066267076989494",
"249434907631169292432704525991203976794",
"24000321900336010795433163882969240477"
]
},
"source": "https://github.com/curl/curl.git/commit/3a09fbb7f264c67c438d01a30669ce325aa508e2",
"target": {
"file": "lib/content_encoding.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-32206-c8d05009",
"digest": {
"length": 874,
"function_hash": "135163556199857411550722417587621050098"
},
"source": "https://github.com/curl/curl.git/commit/3a09fbb7f264c67c438d01a30669ce325aa508e2",
"target": {
"file": "lib/content_encoding.c",
"function": "Curl_build_unencoding_stack"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:05:08Z"
}
}
],
"modified": "2026-10-25T01:05:08.214027881Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-770",
"desc": "Allocation of Resources Without Limits or Throttling"
},
"URL": "https://curl.se/docs/CVE-2022-32206.json",
"www": "https://curl.se/docs/CVE-2022-32206.html",
"award": {
"amount": "2400",
"currency": "USD"
},
"issue": "https://hackerone.com/reports/1570651",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "7.83.1"
}
},
"related_cves": [
{
"value": "CVE-2022-32206",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444336,
"published_at": "2022-06-27T08:00:00+00:00"
}