A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
History

Wed, 14 Oct 2026 12:30:00 +0000


Thu, 16 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2021-09-29T00:00:00.000Z

Updated: 2026-10-14T11:29:20.323Z

Reserved: 2021-01-06T00:00:00.000Z

Link: CVE-2021-22946

cve-icon Vulnrichment

Updated: 2024-08-03T18:58:26.135Z

cve-icon NVD

Status : Modified

Published: 2021-09-29T20:15:08.187

Modified: 2026-10-14T12:17:08.943

Link: CVE-2021-22946

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-09-15T00:00:00Z

Links: CVE-2021-22946 - Bugzilla