CVE-2022-32205

Name	CVE-2022-32205
Description	A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5197-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	buster	7.64.0-4+deb10u2	fixed
	buster (security)	7.64.0-4+deb10u9	fixed
	bullseye (security), bullseye	7.74.0-1.3+deb11u11	fixed
	bookworm, bookworm (security)	7.88.1-10+deb12u5	fixed
	sid, trixie	8.7.1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
curl	source	stretch	(not affected)
curl	source	buster	(not affected)
curl	source	bullseye	7.74.0-1.3+deb11u2	DSA-5197-1
curl	source	(unstable)	7.84.0-1

Notes

[buster] - curl <not-affected> (Vulnerable code introduced later)
[stretch] - curl <not-affected> (Vulnerable code introduced later)
https://curl.se/docs/CVE-2022-32205.html
Introduced by: https://github.com/curl/curl/commit/ed35d6590e72c23c568af1e3b8ac6e4e2d883888 (curl-7_71_0)
Fixed by: https://github.com/curl/curl/commit/48d7064a49148f03942380967da739dcde1cdc24 (curl-7_84_0)