Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2021-22947
n/a https://github.com/curl/curl — When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the serv…
AV AC PR UI S C I A CVSS EPSS %ile KEV
N H N N U N H N 5.9 .0301 87.2 —
AFFECTED
Product Versions Fixed
https://github.com/curl/curl curl 7.20.0 to and including 7.78.0 – —
TIMELINE
Jan 6 Reserved by hackerone
Sep 29 Published (CNA: hackerone)
Oct 14 EXPLOIT PUBLISHED — CVE-2021-22947 (https://github.com/curl/curl). Public exploit reference added.
Description
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| January 6, 2021 | Reserved | Reserved by hackerone |
| September 29, 2021 | Published | Published (CNA: hackerone) |
| October 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2021-22947 (https://github.com/curl/curl). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| n/a | https://github.com/curl/curl | — | curl 7.20.0 to and including 7.78.0 | — |
References (17)
- http://seclists.org/fulldisclosure/2022/Mar/29 [Mailing List, Third Party Advisory]
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf [Patch, Third Party Advisory]
- https://hackerone.com/reports/1334763 [Exploit, Issue Tracking, Third Party Advisory]
- https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html [Mailing List, Third Party Advisory]
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html [Mailing List, Third Party Advisory]
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/ [Mailing List, Third Party Advisory]
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/ [Mailing List, Third Party Advisory]
- https://security.gentoo.org/glsa/202212-01 [Third Party Advisory]
- https://security.netapp.com/advisory/ntap-20211029-0003/ [Third Party Advisory]
- https://support.apple.com/kb/HT213183 [Release Notes, Third Party Advisory]
- https://www.debian.org/security/2022/dsa-5197 [Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuapr2022.html [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujan2022.html [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujul2022.html [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuoct2021.html [Patch, Third Party Advisory]
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-22947 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
