cve/2021/CVE-2021-22945.md

### [CVE-2021-22945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22945)
![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free%20(CWE-415)&color=brighgreen)

### Description

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpuoct2021.html

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/blairdrummond/terragrunt-experiment-demo-app
- https://github.com/devopstales/trivy-operator
- https://github.com/emilkje/trivy-operator-lab
- https://github.com/gatecheckdev/gatecheck
- https://github.com/kenlavbah/log4jnotes