A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation

🗓️ 27 Jan 2026 00:00:00Reported by Broadcom Security ResponseType

broadcom🔗 support.broadcom.com👁 13 Views

Input validation flaw in curl below 8.0 during Telnet negotiation may allow crafted user names and options to execute arbitrary code.

Reporter	Title	Published	Views	Family All 202
FreeBSD	curl -- multiple vulnerabilities	20 Mar 202300:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	15 Jun 202317:06	–	ibm
IBM Security Bulletins	Security Bulletin: cURL as used by IBM QRadar WinCollect Agent contains multiple vulnerabilities	8 Jun 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Progress DataDirect Connect for ODBC	26 Mar 202503:49	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL libcurl might affect IBM Spectrum Copy Data Management	15 Sep 202313:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the RHEL UBI (CVE-2023-27533)	26 Jan 202421:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple publicly disclosed Libcurl vulnerabilities affect IBM Safer Payments	16 May 202322:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboard operands are vulnerable to security restrictions bypass due to [CVE-2022-32221], [CVE-2023-27533], [CVE-2023-28322]	20 Jul 202315:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the RHEL UBI (CVE-2023-27533)	18 Jan 202421:45	–	ibm

27 Jan 2026 19:09Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.8

EPSS0.00179