Medium
Protocol downgrade required TLS bypassed
Type: advisorySources: OSV
A user can tell curl to **require** a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or `CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` with libcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response. This flaw would then make curl silently continue its operations **without TLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-22946
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:37 UTC · Revision 1
Source evidence
A user can tell curl to **require** a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or `CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` with libcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response. This flaw would then make curl silently continue its operations **without TLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
osv:CURL-CVE-2021-22946
Complete source record
{
"id": "d846657a0432ea6f8123f0b2ccd95c70068085b855dd92c6a378e1e7c4ab2497",
"url": "https://osv.dev/vulnerability/CURL-CVE-2021-22946",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Protocol downgrade required TLS bypassed",
"summary": "A user can tell curl to **require** a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or `CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` with libcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response. This flaw would then make curl silently continue its operations **without TLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.",
"evidence": "osv:CURL-CVE-2021-22946",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2021-22946",
"aliases": [
"CURL-CVE-2021-22946",
"CVE-2021-22946"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.20.0"
},
{
"fixed": "7.79.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "ec3bb8f727405642a471b4b1b9eb0118fc003104"
},
{
"fixed": "364f174724ef115c63d5e5dc1d3342c8a43b1cca"
}
]
}
],
"versions": [
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"curl-7_78_0",
"curl-7_77_0",
"curl-7_76_1",
"curl-7_76_0",
"curl-7_75_0",
"curl-7_74_0",
"curl-7_73_0",
"tiny-curl-7_72_0",
"curl-7_72_0",
"curl-7_71_1",
"curl-7_71_0",
"curl-7_70_0",
"curl-7_69_1",
"curl-7_69_0",
"curl-7_68_0",
"curl-7_67_0",
"curl-7_66_0",
"curl-7_65_3",
"curl-7_65_2",
"curl-7_65_1",
"curl-7_65_0",
"curl-7_64_1",
"curl-7_64_0",
"curl-7_63_0",
"curl-7_62_0",
"curl-7_61_1",
"curl-7_61_0",
"curl-7_60_0",
"curl-7_59_0",
"curl-7_58_0",
"curl-7_57_0",
"curl-7_56_1",
"curl-7_56_0",
"curl-7_55_1",
"curl-7_55_0",
"curl-7_54_1",
"curl-7_54_0",
"curl-7_53_1",
"curl-7_53_0",
"curl-7_52_1",
"curl-7_52_0",
"curl-7_51_0",
"curl-7_50_3",
"curl-7_50_2",
"curl-7_50_1",
"curl-7_50_0",
"curl-7_49_1",
"curl-7_49_0",
"curl-7_48_0",
"curl-7_47_1",
"curl-7_47_0",
"curl-7_46_0",
"curl-7_45_0",
"curl-7_44_0",
"curl-7_43_0",
"curl-7_42_1",
"curl-7_42_0",
"curl-7_41_0",
"curl-7_40_0",
"curl-7_39_0",
"curl-7_38_0",
"curl-7_37_1",
"curl-7_37_0",
"curl-7_36_0",
"curl-7_35_0",
"curl-7_34_0",
"curl-7_33_0",
"curl-7_32_0",
"curl-7_31_0",
"curl-7_30_0",
"curl-7_29_0",
"curl-7_28_1",
"curl-7_28_0",
"curl-7_27_0",
"curl-7_26_0",
"curl-7_25_0",
"curl-7_24_0",
"curl-7_23_1",
"curl-7_23_0",
"curl-7_22_0",
"curl-7_21_7",
"curl-7_21_6",
"curl-7_21_5",
"curl-7_21_4",
"curl-7_21_3",
"curl-7_21_2",
"curl-7_21_1",
"curl-7_21_0",
"curl-7_20_1",
"curl-7_20_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2021-22946.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2021-22946-5f144596",
"digest": {
"length": 1486,
"function_hash": "119534646122701985596810460089461806602"
},
"source": "https://github.com/curl/curl.git/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca",
"target": {
"file": "lib/pop3.c",
"function": "pop3_state_capa_resp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2021-22946-6defda8f",
"digest": {
"length": 1471,
"function_hash": "121882031565920873706884467438821109063"
},
"source": "https://github.com/curl/curl.git/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca",
"target": {
"file": "lib/imap.c",
"function": "imap_state_capability_resp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2021-22946-8a197a56",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125838389204512113423578826374606434992",
"289602762837242666987156914818922613493",
"179171292872106229507560278029362949039",
"288183765666519644003398509602037908454",
"92508471392044878020809282144142973764",
"200716318166034695299793617317441905028",
"237539205585906697208226242736627223267",
"20172918918252435435422593274820650882",
"235600200177529034152567186523785762009",
"143830830183920108636701400704792267639",
"35472489082358076191769788912533366959",
"88812204812933384223701543032769186504",
"291080297044442490145969548900492739442",
"257361159714823355691712236385661725414",
"76837617488293126025358191560235520828",
"321745199110042869894544453879523682123",
"236983781727613756833659268006828230790",
"183921628708148935400984650042871557218",
"312127172919749259694804839433778911310",
"302199932979784542806140613615325286349"
]
},
"source": "https://github.com/curl/curl.git/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca",
"target": {
"file": "lib/pop3.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2021-22946-abca795e",
"digest": {
"length": 7576,
"function_hash": "289860418622821423771754231295939751145"
},
"source": "https://github.com/curl/curl.git/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca",
"target": {
"file": "lib/ftp.c",
"function": "ftp_statemachine"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2021-22946-b86032a9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153395863378133571935343146735379407744",
"285266200701391789832679611765445470611",
"75615830266170096220067674219446968251",
"283250084680294900096067565593327260752",
"127576657757363583813654428021904906681"
]
},
"source": "https://github.com/curl/curl.git/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca",
"target": {
"file": "lib/ftp.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2021-22946-ba776a99",
"digest": {
"threshold": 0.9,
"line_hashes": [
"160527311452759011857898395095269034512",
"247702492148198457153099115426495892305",
"154804548404177128963963377829403231875",
"259679513203107684038850942954233625244",
"90769121037072737445177478066611626150",
"37330564880920412587598882536275988455",
"233502198189969766495942293457048742564",
"109799684212471158941812409729383557254",
"271634642669636656141958387753194484974",
"93224878428641017968236855875397843824",
"178215163249609003722299128452939284865",
"88812204812933384223701543032769186504",
"206622970588395643049612311944086829084",
"338141911970717966837196764238683293762",
"88326400223103428612539330923746679711",
"279768642943648353458040874399811963366"
]
},
"source": "https://github.com/curl/curl.git/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca",
"target": {
"file": "lib/imap.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:04:49Z"
}
}
],
"modified": "2026-10-25T01:04:49.684077385Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-325",
"desc": "Missing Cryptographic Step"
},
"URL": "https://curl.se/docs/CVE-2021-22946.json",
"www": "https://curl.se/docs/CVE-2021-22946.html",
"award": {
"amount": "1000",
"currency": "USD"
},
"issue": "https://hackerone.com/reports/1334111",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "7.78.0"
}
},
"related_cves": [
{
"value": "CVE-2021-22946",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444295,
"published_at": "2021-09-15T08:00:00+00:00"
}