Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-27780

26
FAUCET Score

CVE-2022-27780 is a URL parsing vulnerability in curl that allows percent-encoded URL separators in the hostname, leading to misinterpretation of the intended host. This flaw, affecting products like haxx, netapp, and splunk, can bypass security filters and checks. With a CVSS score of 7.5 (High), it presents a network-based attack vector with low complexity and high integrity impact. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness within the cybersecurity landscape.

Impacted Technologies

VendorProductVersion(s)CPE
>= 7.80.0, < 7.83.1CPE matchmatch criteria
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.33%
Probability of exploitation in next 30 days
EPSS Percentile
81.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0233 is in the 67th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

hikvisionpatch availablevia llm_extracted
microsoftpatch availablevia msrc
Product: 18690-16823Fixed in: 7.83.1-1
microsoftpatch availablevia msrc
Product: 18669-16820Fixed in: 7.84.0-1
microsoftpatch availablevia msrc
Product: cm1 curl 7.84.0-1 on CBL Mariner 1.0Fixed in: 7.84.0-1
microsoftpatch availablevia msrc
Product: cbl2 curl 7.83.1-1 on CBL Mariner 2.0Fixed in: 7.83.1-1
zimbrapatch availablevia llm_extracted
Fixed in: 8.2.12, 9.0.6, 9.1.1

Vendor Advisories (4)

zimbrallm-zimbra-9542faa91a6d6884HIGH

August Third Party Package Updates in Splunk Universal Forwarder

Aug 30, 2023
microsoft2022-Jun/CVE-2022-27780Moderate

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL making it a *different* URL usingthe wrong host name when it is later retrieved.For example a URL like `http://example.com%2F127.0.0.1/` would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters checks and more.

Jun 14, 2022
redhatCVE-2022-27780Moderate

curl: percent-encoded path separator in URL host

May 11, 2022
hikvisionllm-hikvision-0d73cb708f288ec5MEDIUM

percent-encoded path separator in URL host

May 11, 2022

References

hackerone.com / reports/1553841
ExploitThird Party Advisory
security.gentoo.org / glsa/202212-01
Third Party Advisory
security.netapp.com / advisory/ntap-20220609-0009
Third Party Advisory