Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-22576

CVE-2022-22576HIGH

n/a https://github.com/curl/curl — An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated conne…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  N    8.1   .0252   84.6     —

AFFECTED
  Product                       Versions                Fixed
  https://github.com/curl/curl  Fixed in curl 7.83.0 –  —

TIMELINE
  Jan 4   Reserved by hackerone
  May 26  Published (CNA: hackerone)
  Oct 14  EXPLOIT PUBLISHED — CVE-2022-22576 (https://github.com/curl/curl). Public exploit reference added.

CWE-306, CWE-287 · CNA: hackerone · CVSS v3.1 · 7 references · NVD status: Modified

Description

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 4, 2022	Reserved	Reserved by hackerone
May 26, 2022	Published	Published (CNA: hackerone)
October 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2022-22576 (https://github.com/curl/curl). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	https://github.com/curl/curl	—	Fixed in curl 7.83.0	—

Weaknesses

CWE-306 · CWE-287

References (7)

https://cert-portal.siemens.com/productcert/html/ssa-146325.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://hackerone.com/reports/1526328 [Exploit, Issue Tracking, Third Party Advisory]
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html [Mailing List, Third Party Advisory]
https://security.gentoo.org/glsa/202212-01 [Third Party Advisory]
https://security.netapp.com/advisory/ntap-20220609-0008/ [Third Party Advisory]
https://www.debian.org/security/2022/dsa-5197 [Third Party Advisory]

Authoritative record: CVE-2022-22576 at cve.org

Weaknesses: CWE-306 · CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-22576 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.