Critical severity · published Sep 23, 2021
CVE-2021-22945
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in…
9.1
CVSS
6.7%
EPSS
No
On KEV
Description
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.7% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
macOS · Apple
12.0.0 before 12.3 · source: NVD
HT
https://github.com/curl/curl ·
curl 7.73.0 to and including 7.78.0 · source: vendor
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
CD
Clustered Data Ontap · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
11.0 · source: NVD
FE
Fedora · Fedoraproject
33; 35 · source: NVD
HF
H300e Firmware · Netapp
All versions, or not specified · source: NVD
HF
H300s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500e Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700e Firmware · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22945
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22945
Mailing List
http://seclists.org/fulldisclosure/2022/Mar/29
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Exploit
https://hackerone.com/reports/1269242
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
Third Party Advisory
https://security.gentoo.org/glsa/202212-01
More from macOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2026-65400
Apple macOS Improper Authentication Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability