Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2022-32205
n/a https://github.com/curl/curl — A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them.
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N R U N N L 4.3 .3150 98.3 —
AFFECTED
Product Versions Fixed
https://github.com/curl/curl Fixed in 7.84.0 – —
TIMELINE
Jun 1 Reserved by hackerone
Jul 7 Published (CNA: hackerone)
Oct 14 EXPLOIT PUBLISHED — CVE-2022-32205 (https://github.com/curl/curl). Public exploit reference added.
Description
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 1, 2022 | Reserved | Reserved by hackerone |
| July 7, 2022 | Published | Published (CNA: hackerone) |
| October 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2022-32205 (https://github.com/curl/curl). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| n/a | https://github.com/curl/curl | — | Fixed in 7.84.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-32205 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
