CVE-2022-277827.5HighCWE-840

CVE-2022-27782: Haxx https://github.com/curl/curl vulnerability

Haxx · https://github.com/curl/curl

Vendor fix available · Affected: Haxx https://github.com/curl/curl · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

3.1%probability of exploitation in the next 30 days

87th percentile

050100

Higher than 87% of scored CVEs

7.5HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

https://github.com/curl/curlFixed in 7.83.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Business Logic Errors · Input Validation and Logic
Vendor: Haxx
Published: June 2022
Band: Possible (1 to 10%), June 2022
Bounty reports: More than 6 disclosed on HackerOne

Disclosed bug bounty reports about CVE-2022-27782

The reports on HackerOne that name this CVE, with HackerOne's own outcome. Titles and metadata only.

SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removalcurl · 2026 · high severityInformative
Missing server identity policy enforcement in SSH connection reuse allows host key verification bypass via pool poisoningcurl · 2026 · high severityN/A
ssh_config_matches is dead code: unauthorized SSH key reusecurl · 2026 · medium severityInformative
CVE-2022-27782: TLS and SSH connection too eager reuseInternet Bug Bounty · 2022 · medium severityValid
CVE-2022-27782: TLS and SSH connection too eager reusecurl · 2022 · medium severityValid
SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connectionscurl · 2026 · low severityN/A

Every report about CVE-2022-27782 on the Atlas

CoverageNo articles yet

No CyberSIXT article names CVE-2022-27782 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.