# CVE-2022-32206: HTTP compression denial of service

curl accepted unbounded chained HTTP compression algorithms, letting a malicious server trigger a malloc bomb and out-of-memory via decompression chains.

- Payout: $2,400
- Severity: medium
- Program: Internet Bug Bounty
- Credited: Harry Sintonen
- Disclosed: 2022-06-27
- CVE: CVE-2022-32206
- Write-up quality: 6/10
- Original: https://curl.se/docs/CVE-2022-32206.html
- Library page: https://bugbountylibrary.com/r/blog%3Acurl-se-docs-cve-2022-32206-html
- Tags: domain:oss impact:dos kind:bounty platform:blog sev:medium tech:curl vuln:dos vuln:misconfiguration

**Target:** HTTP client content/transfer decompression (gzip, brotli, zstd)
**Root cause:** curl supported chained HTTP compression algorithms but never capped the number of links in the decompression chain, so a server could specify a virtually unlimited number of compression steps.
**Steps:**
1. Enable automatic content decompression (default code path reachable via Transfer-Encoding).
2. Malicious server responds with a Content-Encoding or Transfer-Encoding header listing many chained compression algorithms (e.g. `gzip, gzip, gzip, ...`).
3. curl allocates heap for each decompression layer, exhausting memory or returning out-of-memory errors.
**Exploitation:** A malicious or compromised server returns a response whose Content-Encoding/Transfer-Encoding header chains an unbounded number of compression algorithms; curl allocates heap per layer, causing a malloc bomb / OOM denial of service on the client.
**Insight:** When a client supports stacked/chained encodings, check whether the number of layers is bounded; header-driven resource amplification is reachable even with default options via Transfer-Encoding.