critical
CVE-2021-22945
curl: use-after-free and double-free in MQTT sending
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Julia9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner, Julia, Photon OS. Rated lower by Red Hat (medium), Amazon (medium), Ubuntu (medium).
Description
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | curl | 0:7.76.0-6.cm1 |
| CBL-Mariner 2.0 | curl | 0:7.82.0-1.cm2 |
| julia::Julia Ecosystem Security Advisories | LibCURL_jll | 7.81.0+0 |
| Photon OS 1.0 | curl | 7.78.0-2.ph1 |
| Photon OS 2.0 | curl | 7.78.0-2.ph2 |
| Photon OS 3.0 | curl | 7.78.0-2.ph3 |
| Photon OS 4.0 | curl, curl-devel, curl-libs | 7.78.0-2.ph4 |
| alpine 3.11 | curl | 7.79.0-r0 |
| alpine 3.12 | curl | 7.79.0-r0 |
| alpine 3.13 | curl | 7.79.0-r0 |
| alpine 3.14 | curl | 7.79.0-r0 |
| alpine 3.15 | curl | 7.79.0-r0 |
Show all 46 entries from 36 sources
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | curl | 0:7.76.0-6.cm1 |
| CBL-Mariner 2.0 | curl | 0:7.82.0-1.cm2 |
| julia::Julia Ecosystem Security Advisories | LibCURL_jll | 7.81.0+0 |
| Photon OS 1.0 | curl | 7.78.0-2.ph1 |
| Photon OS 2.0 | curl | 7.78.0-2.ph2 |
| Photon OS 3.0 | curl | 7.78.0-2.ph3 |
| Photon OS 4.0 | curl | 7.78.0-2.ph4 |
| Photon OS 4.0 | curl-devel | 7.78.0-2.ph4 |
| Photon OS 4.0 | curl-libs | 7.78.0-2.ph4 |
| alpine 3.11 | curl | 7.79.0-r0 |
| alpine 3.12 | curl | 7.79.0-r0 |
| alpine 3.13 | curl | 7.79.0-r0 |
| alpine 3.14 | curl | 7.79.0-r0 |
| alpine 3.15 | curl | 7.79.0-r0 |
| alpine 3.16 | curl | 7.79.0-r0 |
| alpine 3.17 | curl | 7.79.0-r0 |
| alpine 3.18 | curl | 7.79.0-r0 |
| alpine 3.19 | curl | 7.79.0-r0 |
| alpine 3.20 | curl | 7.79.0-r0 |
| alpine 3.21 | curl | 7.79.0-r0 |
| alpine 3.22 | curl | 7.79.0-r0 |
| alpine 3.23 | curl | 7.79.0-r0 |
| alpine 3.24 | curl | 7.79.0-r0 |
| alpine edge | curl | 7.79.0-r0 |
| amazon linux 2 | curl | 7.79.1-1.amzn2.0.1 |
| amazon linux 2 | curl-debuginfo | 7.79.1-1.amzn2.0.1 |
| amazon linux 2 | libcurl | 7.79.1-1.amzn2.0.1 |
| amazon linux 2 | libcurl-devel | 7.79.1-1.amzn2.0.1 |
| conan::GitLab Advisory Database Community | libcurl | 7.79.1 |
| debian 11 | curl | 7.74.0-1.3+deb11u2 |
| debian 12 | curl | 7.79.1-1 |
| debian 13 | curl | 7.79.1-1 |
| debian 14 | curl | 7.79.1-1 |
| echo | curl | 7.79.1-1 |
| echo | curl-7.69.1 | 7.69.1+e1 |
| Red Hat | curl | no fix listed |
| Red Hat | libcurl | no fix listed |
| Red Hat | rh-dotnet21-curl | no fix listed |
| Red Hat | rh-dotnet21-libcurl | no fix listed |
| Red Hat | rh-dotnet21-libcurl-devel | no fix listed |
| root.io debian 11 | rootio-curl | 7.74.0-1.3+deb11u2 |
| root.io debian 12 | rootio-curl | 7.79.1-1 |
| root.io debian 13 | rootio-curl | 7.79.1-1 |
| ubuntu 21.04 | curl | 7.74.0-1ubuntu2.3 |
| ubuntu 21.10 | curl | 7.74.0-1.3ubuntu2 |
| ubuntu 22.04 | curl | 7.74.0-1.3ubuntu2 |
References
- http://seclists.org/fulldisclosure/2022/Mar/29
- https://access.redhat.com/security/cve/CVE-2021-22945
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://curl.se/docs/CVE-2021-22945.html
- https://hackerone.com/reports/1269242
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
All 17 references
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
- https://nvd.nist.gov/vuln/detail/CVE-2021-22945
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20211029-0003/
- https://support.apple.com/kb/HT213183
- https://ubuntu.com/security/notices/USN-5079-1
- https://www.cve.org/CVERecord?id=CVE-2021-22945
- https://www.debian.org/security/2022/dsa-5197
- https://www.oracle.com/security-alerts/cpuoct2021.html