Vulnerability Intelligence Report
CVE-2021-22945
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:3.9
Impact Score:5.2
EPSS Probability:6.22%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-415 ↗Double Free (CWE-415)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| haxx | libcurl | all |
| fedoraproject | fedora | 33, 35 |
| netapp | cloud_backup | all |
| netapp | clustered_data_ontap | all |
| oracle | mysql_server | all |
| netapp | h300s_firmware | all |
| netapp | h300s | all |
| netapp | h500s_firmware | all |
| netapp | h500s | all |
| netapp | h700s_firmware | all |
| netapp | h700s | all |
| netapp | h300e_firmware | all |
| netapp | h300e | all |
| netapp | h500e_firmware | all |
| netapp | h500e | all |
| netapp | h700e_firmware | all |
| netapp | h700e | all |
| netapp | h410s_firmware | all |
| netapp | h410s | all |
| netapp | solidfire_baseboard_management_controller_firmware | all |
| netapp | solidfire_baseboard_management_controller | all |
| apple | macos | all |
| siemens | sinec_ins | all |
| debian | debian_linux | 11.0 |
| splunk | universal_forwarder | 9.1.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
6.216%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | HackerOne · Bug Bounty Provider · USA |
| Reserved | 2021-01-06T00:00:00 |
| Published | 2021-09-23T00:00:00 |
| Last Updated | 2025-06-09T14:47:23 |
Community Chatter & Buzz