JLSEC-2026-1340

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1340.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1340.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-1340

Upstream

CVE-2021-22947

Published

2026-08-17T13:15:13Z

Modified

2026-08-17T13:30:03Z

Severity

4.3 CVSS_V2 - AV:N/AC:M/Au:N/C:N/I:P/A:N (Source: NVD) CVSS Calculator
5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (Source: NVD) CVSS Calculator

Summary

[none]

Details

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got before the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "database_specific": {
                "status": "Modified"
            },
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22947",
            "id": "CVE-2021-22947",
            "imported": "2026-08-16T08:05:12.579Z",
            "modified": "2026-06-17T03:38:05.227Z",
            "published": "2021-09-29T20:15:08.253Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-22947"
        }
    ]
}

References

Affected packages

Julia / LibCURL_jll

Package

Name: LibCURL_jll
Purl: pkg:julia/LibCURL_jll?uuid=deac9b47-8bc7-5906-a0fe-35ac56dc84c0

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.81.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1340.json"