CVE-2021-22901: Haxx Curl Use-After-Free Vulnerability

CVE-2021-22901 Overview

CVE-2021-22901 is a use-after-free vulnerability in curl versions 7.75.0 through 7.76.1. The flaw exists in libcurl's handling of TLS 1.3 session tickets when using OpenSSL. When a session ticket arrives on a connection shared by multiple transfers, libcurl may dereference a transfer object that has already been freed. A malicious server can exploit this condition to potentially achieve remote code execution in the client. The vulnerability is classified under CWE-416 Use After Free.

Critical Impact
A malicious TLS 1.3 server can trigger memory corruption in libcurl clients reusing HTTP/1.1 or multiplexed HTTP/2 connections, potentially leading to remote code execution.

Affected Products

Haxx curl versions 7.75.0 through 7.76.1 (libcurl built against OpenSSL)
Oracle MySQL Server, Essbase, and multiple Communications Cloud Native Core components
NetApp SolidFire, HCI, OnCommand, SnapCenter, Active IQ Unified Manager, and H-series firmware
Siemens SINEC Infrastructure Network Services and Splunk Universal Forwarder

Discovery Timeline

2021-06-11 - CVE-2021-22901 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22901

Vulnerability Analysis

The vulnerability resides in libcurl's OpenSSL backend, specifically in how it tracks TLS 1.3 session tickets across connection reuse. libcurl registers a callback so that when an asynchronous TLS 1.3 NewSessionTicket message arrives, it can associate the new session with the originating transfer. To do this, libcurl stores a pointer to the in-memory Curl_easy transfer structure on the connection.

If the connection is later reused by another transfer, for example via HTTP/1.1 keep-alive or HTTP/2 multiplexing, the original transfer object may be freed before the server delivers the session ticket. When the ticket finally arrives, the callback dereferences the stale pointer and accesses freed memory. Because that memory contains structures with function pointers, an attacker who can influence heap contents may divert control flow.

Root Cause

The root cause is the missing detachment of the SSL session context from the transfer when the transfer disassociates from the connection. libcurl associated a Curl_easy pointer with the OpenSSL session at setup time but did not clear that association when the transfer detached, leaving a dangling reference inside the still-live connection.

Attack Vector

Exploitation requires a victim libcurl client to connect to an attacker-controlled or compromised TLS 1.3 server, perform multiple transfers over the same connection, and receive a session ticket after the first transfer is destroyed. The attack does not require authentication or user interaction beyond initiating the connection, but it depends on connection reuse timing and heap layout.

 void Curl_detach_connnection(struct Curl_easy *data)
 {
   struct connectdata *conn = data->conn;
-  if(conn)
+  if(conn) {
     Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);
+    Curl_ssl_detach_conn(data, conn);
+  }
   data->conn = NULL;
 }

Source: GitHub curl commit 7f4a9a9b. The patch introduces an explicit Curl_ssl_detach_conn call so the SSL backend clears its reference to the transfer when the transfer is detached from the connection.

   Curl_none_set_engine_default,   /* set_engine_default */
   Curl_none_engines_list,         /* engines_list */
   Curl_none_false_start,          /* false_start */
-  NULL                            /* sha256sum */
+  NULL,                           /* sha256sum */
+  NULL,                           /* associate_connection */
+  NULL                            /* disassociate_connection */
 };

Source: GitHub curl commit 7f4a9a9b. The fix adds new associate_connection and disassociate_connection callbacks to every TLS backend vtable so transfer lifecycle changes are propagated to the SSL layer.

Detection Methods for CVE-2021-22901

Indicators of Compromise

Unexpected crashes in processes linking libcurl.so between versions 7.75.0 and 7.76.1, particularly when TLS 1.3 connections are reused.
Outbound HTTPS connections from server applications to untrusted hosts that issue post-handshake NewSessionTicket messages followed by client memory faults.
Heap corruption signatures or AddressSanitizer use-after-free reports involving OpenSSL session callback frames.

Detection Strategies

Inventory all binaries statically or dynamically linked against vulnerable curl builds using software composition analysis tools and SBOM data.
Monitor process telemetry for abnormal child processes, unexpected memory regions, or crashes originating in curl-dependent applications.
Inspect outbound TLS traffic for unusual session ticket activity following connection reuse from internal hosts to attacker-controlled destinations.

Monitoring Recommendations

Enable application crash dump collection for services that embed libcurl and forward dumps to a centralized analysis pipeline.
Alert on egress TLS 1.3 connections from server workloads to non-allowlisted external endpoints, particularly long-lived multiplexed sessions.
Track patch status of curl, Oracle, NetApp, Siemens, and Splunk products listed in vendor advisories and report drift.

How to Mitigate CVE-2021-22901

Immediate Actions Required

Upgrade curl and libcurl to version 7.77.0 or later across all systems, container images, and build pipelines.
Apply vendor-specific patches from Oracle Critical Patch Updates (July 2021, January 2022, April 2022), NetApp advisories NTAP-20210723-0001 and NTAP-20210727-0007, and Siemens SSA-389290 and SSA-732250.
Identify embedded copies of libcurl in third-party software and request updated builds from vendors where direct patching is not possible.

Patch Information

The upstream fix is available in curl 7.77.0 and is committed in curl commit 7f4a9a9b. Refer to the curl CVE-2021-22901 advisory for the official changelog. Affected vendors have shipped corresponding updates documented in the Oracle CPU July 2021 advisory, the NetApp advisory NTAP-20210723-0001, and the Siemens advisory SSA-389290.

Workarounds

Disable TLS 1.3 session tickets in client configurations where the curl version cannot be upgraded immediately.
Restrict outbound HTTPS from libcurl-dependent services to a vetted allowlist of destinations to reduce exposure to malicious servers.
Avoid connection reuse by disabling HTTP/2 multiplexing and HTTP/1.1 keep-alive in affected applications until patches are deployed.

bash

# Verify installed curl version and upgrade on Debian/Ubuntu
curl --version | head -n 1
sudo apt-get update && sudo apt-get install --only-upgrade curl libcurl4

# Verify the fix is present (expect 7.77.0 or later)
curl --version | head -n 1