Versions of cURL / libcURL older than 7.40.0 are unpatched for a security bypass vulnerability because it fails to properly handle URLs with embedded end-of-line characters. Specifically, this issue affects the βparseurlandfillconn()β function of the βlib/url.cβ source file. An attacker can exploit this issue to inject additional headers to the request or construct additional requests.
Binary data 8620.prm