When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` …

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2022-32221 · Microsoft / collected KEV context

cve-program · CVE-2022-32221

• https://hackerone.com/reports/1704017
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20230110-0006/
• https://support.apple.com/kb/HT213604
• https://support.apple.com/kb/HT213605
• http://seclists.org/fulldisclosure/2023/Jan/20
• http://seclists.org/fulldisclosure/2023/Jan/19
• https://www.debian.org/security/2023/dsa-5330
• https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
• https://security.netapp.com/advisory/ntap-20230208-0002/
• http://www.openwall.com/lists/oss-security/2023/05/17/4

No related operational record is retained in the current change model.