Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

curl and libcurl may stop working after many compression steps

published 4 years ago
Summary

The curl command‑line tool and its libraries on CentOS can encounter errors when handling data that is compressed too many times or when processing certain authentication data. This can cause requests to fail, potentially disrupting scripts or applications that rely on curl. Update the curl packages on your CentOS systems to the latest versions to apply the fixes.

What to do
  • Update centos curl to version 7.61.1-22.el8.tuxcare.els4.
  • Update centos curl-minimal to version 7.61.1-22.el8.tuxcare.els4.
  • Update centos libcurl to version 7.61.1-22.el8.tuxcare.els4.
  • Update centos libcurl-devel to version 7.61.1-22.el8.tuxcare.els4.
  • Update centos libcurl-minimal to version 7.61.1-22.el8.tuxcare.els4.
Affected software
Ecosystem VendorProductAffected versions
TuxCare:CentOS:8.5 centos curl < 7.61.1-22.el8.tuxcare.els4
Fix: upgrade to 7.61.1-22.el8.tuxcare.els4
TuxCare:CentOS:8.5 centos curl-minimal < 7.61.1-22.el8.tuxcare.els4
Fix: upgrade to 7.61.1-22.el8.tuxcare.els4
TuxCare:CentOS:8.5 centos libcurl < 7.61.1-22.el8.tuxcare.els4
Fix: upgrade to 7.61.1-22.el8.tuxcare.els4
TuxCare:CentOS:8.5 centos libcurl-devel < 7.61.1-22.el8.tuxcare.els4
Fix: upgrade to 7.61.1-22.el8.tuxcare.els4
TuxCare:CentOS:8.5 centos libcurl-minimal < 7.61.1-22.el8.tuxcare.els4
Fix: upgrade to 7.61.1-22.el8.tuxcare.els4
Original advisory text
Fixed CVEs in curl: CVE-2022-32208, CVE-2022-32206
- CVE-2022-32208: krb5: fix returning error on decode errors
- CVE-2022-32206: content_encoding: return error on too many compression steps
- fix a curl.spec's comment about applying TuxCare ELS patches
- improve the test system by repeating failed tests several times
References
Timeline
Published14 Sep 2022
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2022-1663184017 · OSV
Track software like this
Free during beta