✓ProveIt
Examples / Report #1570651 Saved analysis

CVE-2022-32206: HTTP compression denial of service

curl · 2022-05-158.6s analysis · $0.007 in model calls

What the report claims

Curl does not prevent resource consumption when processing certain header types, leading to uncontrolled resource consumption, application termination, and potential system crashes.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2022-32206 HTTP compression denial of service

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Why this finding?
  • No curl source code was provided for the target revision (bda0d5fb8428), so all claims are not_verifiable against the code.
  • The report includes concrete reproduction steps and a specific revision, making it plausible and actionable for a human reviewer with access to the codebase.
  • Deterministic check confirms CURLOPT_ACCEPT_ENCODING exists, supporting that the option mentioned in C4 is real.
  • Without the header-parsing and cookie-parsing code, it is impossible to determine whether bounds checks or resource limits exist.
What still needs checking
  • curl source code for revision bda0d5fb8428, especially header parsing (Transfer-Encoding, Content-Encoding, Set-Cookie) and any decompression/cookie storage logic.
How this analysis ran 6 claims · 0 citations verified

Checked against curl master on 2022-05-15 (bda0d5fb8428). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
grounded
no model · 1 references checked out, 0 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
6 claims · 1435 tokens · $0.0002
3 · Evidence
0 code snippets
real curl source at bda0d5fb8428
4 · Judgment
Nemotron-3-Ultra-550b-a55b
3412 tokens · 7.0s · $0.0064
5 · Receipts
0 of 0 citations verified
every citation must point at code the judge was shown
Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report with reproduction steps. To assess this, we need to examine the header-parsing code at the revision you tested (bda0d5fb8428). Could you confirm the exact curl version or commit you used? We'll review the Transfer-Encoding, Content-Encoding, and Set-Cookie handling for missing resource limits.

Inspect all claims and source code 6 claims · 0 code excerpts

Report claims

C1flaw not verifiable

Curl does not prevent resource consumption when processing certain header types

Read the reasoning

No curl source code was provided for revision bda0d5fb8428. Cannot verify whether curl prevents resource consumption when processing Transfer-Encoding, Content-Encoding, or Set-Cookie headers.

C2flaw not verifiable

Keeps on allocating more and more resources until the application terminates

Read the reasoning

No curl source code provided. Cannot verify whether curl keeps allocating resources without bounds when processing the described headers.

C3trigger not verifiable

Sending many Transfer-Encoding with repeated encodings such as "gzip,gzip,gzip,..."

Read the reasoning

No curl source code provided. Cannot verify the code path for parsing repeated Transfer-Encoding headers with many 'gzip' entries.

C4trigger not verifiable

If CURLOPT_ACCEPT_ENCODING is set sending many Content-Encoding with repeated encodings such as "gzip,gzip,gzip,..."

Read the reasoning

Deterministic check confirms CURLOPT_ACCEPT_ENCODING exists at this revision, but no source code provided to verify the Content-Encoding parsing path when that option is set.

C5trigger not verifiable

Sending many Set-Cookie with unique cookie names and about 4kbyte value

Read the reasoning

No curl source code provided. Cannot verify the Set-Cookie parsing path and whether it imposes limits on cookie count or value size.

C6impact not verifiable

Application terminates when it runs out of memory

Read the reasoning

No curl source code provided. The described OOM termination is a consequence claim; cannot verify the allocation behavior that leads to it.

Read the original report

Full report on HackerOne ↗

## Summary: Curl does not prevent resource consumption when processing certain header types, but keeps on allocating more and more resources until the application terminates (or the system crashes, see below). The attack vectors include (at least): - Sending many `Transfer-Encoding`with repeated encodings such as "gzip,gzip,gzip,..." - if `CURLOPT_ACCEPT_ENCODING` is set sending many `Content-Encoding` with repeated encodings such as "gzip,gzip,gzip,..." - Sending many `Set-Cookie` with unique cookie names and about 4kbyte value ## Steps To Reproduce: 1.Run the following HTTP server: `perl -e 'print "HTTP/1.1 200 OK\r\n";for (my $i=0; $i < 10000000; $i++) { printf "Transfer-Encoding: " . "gzip," x 20000 . "\r\n"; }' | nc -v -l -p 9999` 2. `curl http://localhost:9999` The application will terminate when it runs out of memory. On macOS the app dies due to OOM: ``` Killed: 9 $ echo $? 137 ``` On linux it's the same: ``` Killed $ echo $? 137 ``` When targeting Windows 11 system the system would stop responding. Once the attack script was terminated the system would not recover after 10 minutes of waiting. While it was possible to log on to the system the display would remain black. Rebooting the system was necessary to recover the system to a working state. This of course is likely due to bugs in the Windows operating system or drivers. On other platforms nasty effects may also occur, such as causing extreme swapping or a system crash. Depending on how the system handles the application gobbling all memory it may result in collateral damage, for example when kernel attempts to release system resources by killing processes. ## Impact - Uncontrolled resource consumption - Uncontrolled application termination - System crash (on some platforms)

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.