Disclosure summary
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.
Source-reported weakness categories
CWE-416
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2021-22901
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| haxx | curl | * {"versionStartIncluding":"7.75.0","versionEndIncluding":"7.76.1"} |
| oracle | communications_cloud_native_core_binding_support_function | 1.11.0 |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.0 |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.1 |
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 |
| oracle | communications_cloud_native_core_service_communication_proxy | 1.15.0 |
| oracle | essbase | * {"versionStartIncluding":"21.0","versionEndExcluding":"21.3"} |
| oracle | mysql_server | * {"versionStartIncluding":"8.0.0","versionEndIncluding":"8.0.25"} |
| netapp | active_iq_unified_manager | - |
| netapp | active_iq_unified_manager | - |
| netapp | cloud_backup | - |
| netapp | oncommand_insight | - |
| netapp | oncommand_workflow_automation | - |
| netapp | snapcenter | - |
| netapp | solidfire,_enterprise_sds_&_hci_storage_node | - |
| netapp | solidfire_&_hci_management_node | - |
| netapp | solidfire_baseboard_management_controller_firmware | - |
| netapp | hci_compute_node_firmware | - |
| netapp | h300e_firmware | - |
| netapp | h300s_firmware | - |
| netapp | h410s_firmware | - |
| netapp | h500e_firmware | - |
| netapp | h500s_firmware | - |
| netapp | h700e_firmware | - |
| netapp | h700s_firmware | - |
| siemens | sinec_infrastructure_network_services | * {"versionEndExcluding":"1.0.1.1"} |
| splunk | universal_forwarder | * {"versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.6"} |
| splunk | universal_forwarder | 9.1.0 |
Original records & references
- NIST NVD record
- CVE Program record
- cert-portal.siemens.com — Patch, Third Party Advisory
- cert-portal.siemens.com — Third Party Advisory
- curl.se — Exploit, Patch, Vendor Advisory
- github.com — Patch, Third Party Advisory
- hackerone.com — Exploit, Issue Tracking, Third Party Advisory
- security.netapp.com — Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- cert-portal.siemens.com — Patch, Third Party Advisory
- cert-portal.siemens.com — Third Party Advisory
- curl.se — Exploit, Patch, Vendor Advisory
- github.com — Patch, Third Party Advisory
- hackerone.com — Exploit, Issue Tracking, Third Party Advisory
- security.netapp.com — Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
PUBLISHED 2021-06-11T12:15:11-04:00
MODIFIED 2026-10-08T17:17:33-04:00
INGESTED 2026-10-10T20:50:20-04:00