CVE-2022-35252

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CVSS 3.1

3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

3.8% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-25)

CWE

CWE-20

Published

2022-09-23

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• apple:macos
• debian:debian_linux
• haxx:curl
• netapp:bootstrap_os
• netapp:clustered_data_ontap
• netapp:element_software
• netapp:h300s_firmware
• netapp:h410s_firmware
• netapp:h500s_firmware
• netapp:h700s_firmware
• netapp:hci_management_node
• netapp:solidfire
• splunk:universal_forwarder

References

• http://seclists.org/fulldisclosure/2023/Jan/20
• http://seclists.org/fulldisclosure/2023/Jan/21
• https://hackerone.com/reports/1613943
• https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
• https://security.gentoo.org/glsa/202212-01

Check your stackJSON