Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-22926

CVE-2021-22926HIGH

n/a https://github.com/curl/curl — libcurl-using applications can ask for a specific client certificate to be used in a transfer.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .1514   96.7     —

AFFECTED
  Product                       Versions                              Fixed
  https://github.com/curl/curl  curll 7.33.0 to and include 7.77.0 –  —

TIMELINE
  Jan 6   Reserved by hackerone
  Aug 5   Published (CNA: hackerone)
  Oct 14  EXPLOIT PUBLISHED — CVE-2021-22926 (https://github.com/curl/curl). Public exploit reference added.

CWE-295, CWE-840 · CNA: hackerone · CVSS v3.1 · 13 references · NVD status: Modified

Description

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 6, 2021	Reserved	Reserved by hackerone
August 5, 2021	Published	Published (CNA: hackerone)
October 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2021-22926 (https://github.com/curl/curl). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	https://github.com/curl/curl	—	curll 7.33.0 to and include 7.77.0	—

Weaknesses

CWE-295 · CWE-840

References (13)

https://cert-portal.siemens.com/productcert/html/ssa-389290.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf [Patch, Third Party Advisory]
https://hackerone.com/reports/1234760 [Exploit, Third Party Advisory]
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E [Mailing List, Third Party Advisory]
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E [Mailing List, Third Party Advisory]
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E [Mailing List, Third Party Advisory]
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E [Mailing List, Third Party Advisory]
https://security.gentoo.org/glsa/202212-01 [Third Party Advisory]
https://security.netapp.com/advisory/ntap-20210902-0003/ [Third Party Advisory]
https://security.netapp.com/advisory/ntap-20211022-0003/ [Third Party Advisory]
https://www.oracle.com/security-alerts/cpujan2022.html [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpuoct2021.html [Patch, Third Party Advisory]

Authoritative record: CVE-2021-22926 at cve.org

Weaknesses: CWE-295 · CWE-840

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-22926 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.