Medium
OAUTH2 bearer bypass in connection reuse
Type: advisorySources: OSV
libcurl might reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMTP(S), IMAP(S), POP3(S) and LDAP(S) (OpenLDAP only). libcurl maintains a pool of live connections after a transfer has completed (sometimes called the connection cache). This pool of connections is then gone through when a new transfer is requested and if there is a live connection available that can be reused, it is preferred instead of creating a new one. Due to this security vulnerability, a connection that is successfully created and authenticated with a username + OAUTH2 bearer could subsequently be erroneously reused even for user + [other OAUTH2 bearer], even though that might not even be a valid bearer. This could lead to an authentication bypass, either by mistake or by a malicious actor.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-22576
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:40 UTC · Revision 1
Source evidence
libcurl might reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMTP(S), IMAP(S), POP3(S) and LDAP(S) (OpenLDAP only). libcurl maintains a pool of live connections after a transfer has completed (sometimes called the connection cache). This pool of connections is then gone through when a new transfer is requested and if there is a live connection available that can be reused, it is preferred instead of creating a new one. Due to this security vulnerability, a connection that is successfully created and authenticated with a username + OAUTH2 bearer could subsequently be erroneously reused even for user + [other OAUTH2 bearer], even though that might not even be a valid bearer. This could lead to an authentication bypass, either by mistake or by a malicious actor.
osv:CURL-CVE-2022-22576
Complete source record
{
"id": "5805360b2abea0995165daed3f9ec531536ba06c78f2675c419b00352d009bb6",
"url": "https://osv.dev/vulnerability/CURL-CVE-2022-22576",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OAUTH2 bearer bypass in connection reuse",
"summary": "libcurl might reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMTP(S), IMAP(S), POP3(S) and LDAP(S) (OpenLDAP only). libcurl maintains a pool of live connections after a transfer has completed (sometimes called the connection cache). This pool of connections is then gone through when a new transfer is requested and if there is a live connection available that can be reused, it is preferred instead of creating a new one. Due to this security vulnerability, a connection that is successfully created and authenticated with a username + OAUTH2 bearer could subsequently be erroneously reused even for user + [other OAUTH2 bearer], even though that might not even be a valid bearer. This could lead to an authentication bypass, either by mistake or by a malicious actor.",
"evidence": "osv:CURL-CVE-2022-22576",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2022-22576",
"aliases": [
"CURL-CVE-2022-22576",
"CVE-2022-22576"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.33.0"
},
{
"fixed": "7.83.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "19a05c908f7d8be82de6f69f533317d8a0db49dd"
},
{
"fixed": "852aa5ad351ea53e5f01d2f44b5b4370c2bf5425"
}
]
}
],
"versions": [
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"curl-7_82_0",
"curl-7_81_0",
"curl-7_80_0",
"curl-7_79_1",
"curl-7_79_0",
"curl-7_78_0",
"curl-7_77_0",
"curl-7_76_1",
"curl-7_76_0",
"curl-7_75_0",
"curl-7_74_0",
"curl-7_73_0",
"tiny-curl-7_72_0",
"curl-7_72_0",
"curl-7_71_1",
"curl-7_71_0",
"curl-7_70_0",
"curl-7_69_1",
"curl-7_69_0",
"curl-7_68_0",
"curl-7_67_0",
"curl-7_66_0",
"curl-7_65_3",
"curl-7_65_2",
"curl-7_65_1",
"curl-7_65_0",
"curl-7_64_1",
"curl-7_64_0",
"curl-7_63_0",
"curl-7_62_0",
"curl-7_61_1",
"curl-7_61_0",
"curl-7_60_0",
"curl-7_59_0",
"curl-7_58_0",
"curl-7_57_0",
"curl-7_56_1",
"curl-7_56_0",
"curl-7_55_1",
"curl-7_55_0",
"curl-7_54_1",
"curl-7_54_0",
"curl-7_53_1",
"curl-7_53_0",
"curl-7_52_1",
"curl-7_52_0",
"curl-7_51_0",
"curl-7_50_3",
"curl-7_50_2",
"curl-7_50_1",
"curl-7_50_0",
"curl-7_49_1",
"curl-7_49_0",
"curl-7_48_0",
"curl-7_47_1",
"curl-7_47_0",
"curl-7_46_0",
"curl-7_45_0",
"curl-7_44_0",
"curl-7_43_0",
"curl-7_42_1",
"curl-7_42_0",
"curl-7_41_0",
"curl-7_40_0",
"curl-7_39_0",
"curl-7_38_0",
"curl-7_37_1",
"curl-7_37_0",
"curl-7_36_0",
"curl-7_35_0",
"curl-7_34_0",
"curl-7_33_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2022-22576.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2022-22576-0eca3534",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58259199269834853276010218403496030245",
"294396197503886632286020947397231640911",
"78590371543023549742567242977345257926",
"200816818971994359683925580495066280726"
]
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/urldata.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-17e36f02",
"digest": {
"threshold": 0.9,
"line_hashes": [
"86903027126095287104123757752708765486",
"44720551875179399004381956353178122180",
"34879492751838601925948714301221924352",
"307688321766610902876175559712764398889",
"245139514547154983925921870038563502633",
"110890051936132654875175968532763685530",
"297062367226438086812293607233676715413",
"197375962886441159790956219057648396496",
"248016129877143886229574845968160069824",
"71686248172881489132962617559909369894",
"149040547399085134523628283748476493915",
"44626021511392020250969829294805214661",
"181173808768575193318751601021425637446",
"294988164769936192321497125215764979042",
"305847340517085724868082159878178147697",
"29973701791926881430846087993158545998",
"145600217765864882581341827729333230521",
"82999712505788900535937068531666439223",
"162937275451028946642750577947894658454",
"125341153304869410480491850512867873541"
]
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/vtls/vtls.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-1ed77fdc",
"digest": {
"length": 10210,
"function_hash": "232769562899590504328816257288465941567"
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/url.c",
"function": "create_conn"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-2827ee1b",
"digest": {
"length": 1240,
"function_hash": "315632358659867224200111941378429278205"
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/url.c",
"function": "conn_free"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-656aa914",
"digest": {
"length": 7730,
"function_hash": "313306748003713758833708885016493009832"
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/url.c",
"function": "ConnectionExists"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-84935836",
"digest": {
"length": 179,
"function_hash": "49760104068136346591452435977634428264"
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/vtls/vtls.c",
"function": "safecmp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-9a848b3c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205626891793478041329601926580379702650"
]
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/strcase.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-c615994b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"248080550513763933379421547446316423509",
"31680295949215721977297077975251584896",
"312319431893952030470025865649966935262",
"318263350038963178288788772173899173632",
"77096557681742886896863986532760488600",
"206619088639161047010868169248691550821",
"124080114129794289289393572187731930758",
"230523409755139232336302673927471314284",
"183487641048656492491546255641374939470",
"164766160184776116373789411106026226164",
"101567081819988502529662363128725017594"
]
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2022-22576-e1dd1415",
"digest": {
"threshold": 0.9,
"line_hashes": [
"176084909825676078863161205171299297476",
"328827321545062459626361455841054239451",
"110144098323748351620261025060077450548"
]
},
"source": "https://github.com/curl/curl.git/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425",
"target": {
"file": "lib/strcase.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:16:43Z"
}
}
],
"modified": "2026-10-25T01:16:43.982844420Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-305",
"desc": "Authentication Bypass by Primary Weakness"
},
"URL": "https://curl.se/docs/CVE-2022-22576.json",
"www": "https://curl.se/docs/CVE-2022-22576.html",
"award": {
"amount": "2400",
"currency": "USD"
},
"issue": "https://hackerone.com/reports/1526328",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "7.82.0"
}
},
"related_cves": [
{
"value": "CVE-2022-22576",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444435,
"published_at": "2022-04-27T08:00:00+00:00"
}