HighFix available
curl — security advisory
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
- Products
- curl
- Affected versions
- Not specified
- Fixed versions
- 7.79.1-r2, 7.80.0-r2, 7.83.1-r0
- CVEs
- CVE-2022-27782
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:11 UTC · Revision 1
Source evidence
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
osv:ALPINE-CVE-2022-27782
curl
Fixed versions: 7.79.1-r2
curl
Fixed versions: 7.79.1-r2
curl
Fixed versions: 7.80.0-r2
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
curl
Fixed versions: 7.83.1-r0
Complete source record
{
"id": "5e81244125906b75423fa01f3c54b7f6cea1061d5aa852949feb8ff59985da0f",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2022-27782",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2022-27782",
"summary": "libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.",
"evidence": "osv:ALPINE-CVE-2022-27782",
"products": [
{
"name": {
"value": "curl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.79.1-r2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.79.1-r2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.80.0-r2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.83.1-r0",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "ALPINE-CVE-2022-27782",
"aliases": [
"ALPINE-CVE-2022-27782"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.79.1-r2"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.79.1-r2"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.80.0-r2"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.83.1-r0"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:apk/alpine/curl?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-27782.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-15T07:17:54.195217094Z",
"provider": "osv",
"upstream": [
"CVE-2022-27782"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2022-27782"
]
},
"related_cves": [
{
"value": "CVE-2022-27782",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 321807,
"published_at": "2022-06-02T14:15:44.663+00:00"
}