AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2021-22901

HIGH · CVSS 8.1 EPSS 60.12% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2021-06-11 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.1. It affects OpenSSL. Public exploit code or proof-of-concept references have been detected in its references. Its EPSS score suggests a 60.1% probability of exploitation in the next 30 days. It may be remotely exploitable.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2021-22901
Severity
HIGH
CVSS
8.1
EPSS
60.12%
OpenSSL

Original NVD Description

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

Related CVEs

Other vulnerabilities affecting the same vendor(s)