{"id":"CURL-CVE-2021-22945","summary":"UAF and double free in MQTT sending","details":"When sending data to an MQTT server, libcurl could in some circumstances\nerroneously keep a pointer to an already freed memory area and both use that\nagain in a subsequent call to send data and also free it *again*.","aliases":["CVE-2021-22945"],"modified":"2026-05-27T02:29:10.423594Z","published":"2021-09-15T08:00:00Z","database_specific":{"award":{"amount":"1000","currency":"USD"},"issue":"https://hackerone.com/reports/1269242","package":"curl","severity":"Medium","www":"https://curl.se/docs/CVE-2021-22945.html","CWE":{"desc":"Double Free","id":"CWE-415"},"URL":"https://curl.se/docs/CVE-2021-22945.json","affects":"both","last_affected":"7.78.0"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.73.0"},{"fixed":"7.79.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"2522903b792ac5a802f780df60dc4647c58e2477"},{"fixed":"43157490a5054bd24256fe12876931e8abc9df49"}]}],"versions":["7.78.0","7.77.0","7.76.1","7.76.0","7.75.0","7.74.0","7.73.0","curl-7_78_0","curl-7_77_0","curl-7_76_1","curl-7_76_0","curl-7_75_0","curl-7_74_0","curl-7_73_0","tiny-curl-7_72_0","curl-7_72_0","curl-7_71_1","curl-7_71_0","curl-7_70_0"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2021-22945.json","vanir_signatures_modified":"2026-05-27T02:29:10Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/43157490a5054bd24256fe12876931e8abc9df49","target":{"file":"lib/mqtt.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["328453786080658004361491463965998398485","252156255408452342459258152853300683062","171447148363748109589151842825259079707","175104515688157307960582739896490386086"]},"id":"CURL-CVE-2021-22945-396483fd"},{"id":"CURL-CVE-2021-22945-49a9eb3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/43157490a5054bd24256fe12876931e8abc9df49","target":{"file":"lib/mqtt.c","function":"mqtt_send"},"deprecated":false,"digest":{"function_hash":"258886550320820673026644183473732966147","length":560}}]}}],"schema_version":"1.7.5","credits":[{"name":"z2_","type":"FINDER"},{"name":"z2_","type":"REMEDIATION_DEVELOPER"}]}