CVE-2022-32206: Haxx Curl DOS Vulnerability

CVE-2022-32206 Overview

CVE-2022-32206 is a resource exhaustion vulnerability affecting curl versions prior to 7.84.0. The vulnerability exists in how curl handles "chained" HTTP compression algorithms, where a server response can be compressed multiple times using potentially different algorithms. Due to missing limits on the number of acceptable "links" in this decompression chain, a malicious server can insert a virtually unlimited number of compression steps. This can result in a "malloc bomb" where curl ends up allocating enormous amounts of heap memory or returning out-of-memory errors, leading to denial of service conditions.

Critical Impact

A malicious server can trigger excessive memory allocation in curl clients through unlimited compression chain expansion, causing denial of service through memory exhaustion.

Affected Products

• Haxx curl versions prior to 7.84.0
• Fedora 35
• Debian Linux 10.0 and 11.0
• NetApp Clustered Data ONTAP, Element Software, HCI Management Node, SolidFire
• NetApp HCI Compute Node and Bootstrap OS
• NetApp H300S, H500S, H700S, H410S and associated firmware
• Siemens SCALANCE SC622-2C, SC626-2C, SC632-2C, SC636-2C, SC642-2C, SC646-2C and associated firmware
• Splunk Universal Forwarder

Discovery Timeline

• July 7, 2022 - CVE-2022-32206 published to NVD
• May 5, 2025 - Last updated in NVD database

Technical Details for CVE-2022-32206

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists in curl's HTTP response decompression handling logic. When curl receives an HTTP response, it supports automatic decompression of compressed content. The protocol allows for multiple compression layers (chained compression), where each layer can use different compression algorithms such as gzip, deflate, or brotli.

The vulnerability allows a malicious server to exploit this feature by sending responses with an excessive number of compression layers. Without proper bounds checking on the decompression chain length, curl attempts to decompress all layers, allocating memory for each intermediate decompressed result. This can lead to exponential memory consumption as each decompression step may produce output larger than its input.

Root Cause

The root cause is the absence of a limit on the number of compression "links" that curl will process in a decompression chain. The code responsible for handling HTTP content encoding did not implement any bounds checking to prevent excessive chaining. This oversight allows an attacker-controlled server to dictate how many decompression operations curl performs, directly translating to unbounded memory allocation.

Attack Vector

The attack requires user interaction where a victim must connect to a malicious server using a vulnerable curl client. The malicious server responds with an HTTP response containing an extremely long chain of Content-Encoding headers. Each encoding layer in the chain causes curl to allocate additional heap memory for decompression buffers.

The attack works by constructing a response where each compression layer, when decompressed, yields data that appears to be another compressed layer. The decompression process continues recursively until system memory is exhausted or curl returns an out-of-memory error. This effectively creates a denial of service condition against the client application using curl.

Detection Methods for CVE-2022-32206

Indicators of Compromise

• Unusual memory consumption spikes in processes utilizing curl library functions
• HTTP responses with abnormally long or multiple Content-Encoding header chains
• Out-of-memory errors in applications that use curl for HTTP client functionality
• Process crashes or terminations due to memory allocation failures

Detection Strategies

• Monitor for HTTP responses containing multiple chained Content-Encoding values from external servers
• Implement memory usage monitoring for curl-dependent applications with alerting on abnormal growth patterns
• Deploy network inspection rules to identify responses with excessive compression encoding chains
• Review application logs for memory allocation failures or out-of-memory conditions in curl operations

Monitoring Recommendations

• Establish baseline memory utilization for services using curl and alert on significant deviations
• Configure network monitoring to inspect and flag HTTP responses with more than typical compression layers
• Implement process-level memory limits using cgroups or similar mechanisms for curl-dependent services
• Enable detailed logging for HTTP client operations to capture encoding header information

How to Mitigate CVE-2022-32206

Immediate Actions Required

• Upgrade curl to version 7.84.0 or later where the decompression chain limit has been implemented
• Review and update all systems and applications that bundle or depend on curl library
• Apply vendor-specific patches for affected products including NetApp, Siemens, and Splunk software
• Implement network-level filtering to limit or inspect HTTP Content-Encoding headers from untrusted sources

Patch Information

The vulnerability has been addressed in curl version 7.84.0 and later, which implements proper limits on the HTTP compression decompression chain. Multiple vendors have released security advisories and patches for affected products. For detailed patch information, refer to the Siemens Security Advisory SSA-333517, NetApp Security Advisory ntap-20220915-0003, Debian Security Advisory DSA-5197, and Gentoo Security Advisory GLSA 2022-12-01. Additional information can be found in the original HackerOne Report #1570651.

Workarounds

• Configure network security devices to limit or block HTTP responses with excessive compression encoding layers
• Implement application-level memory limits for processes using curl to prevent system-wide impact
• Consider disabling automatic HTTP decompression in curl if not required for application functionality
• Deploy proxy servers that normalize HTTP encoding headers before forwarding to internal clients

# Check current curl version
curl --version

# Update curl on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade curl libcurl4

# Update curl on RHEL/CentOS systems
sudo yum update curl libcurl

# Update curl on Fedora systems
sudo dnf update curl libcurl