CVE-2025-53371: Uncontrolled Resource Consumption

DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and filegetcontents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls...

curl: Arbitrary File Read via file:// Protocol in cURL

cURL’s file:// protocol handler is enabled by default, allowing access to local files on the system. This behavior enables an attacker with the ability to run cURL commands to read arbitrary files on the host by specifying file paths or using directory traversal techniques. Steps to reproduce: 1...

curl: access notes without permission

https://web.archive.org/web//https://github.com/curl/curl Impact Summary: access notes without permission...

CVE-2025-7103 BoyunCMS curl Index.php server-side request forgery

A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The...

CVE-2025-7103: Server-Side Request Forgery (SSRF)

A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The...

BoyunCMS security vulnerabilities

BoyunCMS is an enterprise content management system from China Boyun Boyun Company. A security vulnerability exists in BoyunCMS 1.4.20 and earlier versions, which originates from improper handling of the component curl in the file /application/pay/controller/Index.php, which may lead to server-si...

curl: Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations

Summary: The HTTP/2 proxy implementation in curl contains potential integer overflow vulnerabilities in buffer size calculations that could lead to memory corruption or denial of service. AI Usage Statement: This report was prepared by a human security researcher after manual code review. No AI w...

curl-8.14.1-4.1 on GA media (moderate)

curl-8.14.1-4.1 on GA media Announcement ID: openSUSE-SU-2025:15213-1 Rating: moderate Cross-References: CVE-2025-5399 CVSS scores: CVE-2025-5399 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2025-5399 SUSE : 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affect...

OPENSUSE-SU-2025:15213-1 curl-8.14.1-4.1 on GA media

These are all security issues fixed in the curl-8.14.1-4.1 package on the GA media of openSUSE Tumbleweed...

curl: HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling

Summary A logic flaw in libcurl version 8.14.1 allows an attacker to bypass restrictive HTTP proxy firewalls by "tunneling" an arbitrary HTTP verb within a CONNECT request. By setting CURLOPTCUSTOMREQUEST to CONNECT for a standard http:// URL, an attacker can trick libcurl into creating a hybrid...

Moodle security vulnerabilities

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from a DNS rebinding risk in cURL request processing...

Photon OS 3.0: Curl PHSA-2024-3.0-0743

An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-3.0-0743. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CLSA-2025-1751135005 curl: Fix of CVE-2024-7264

CVE-2024-7264: fix out-of-bound read in GTime2str function...

curl: arbitrary file read via `file://` path traversal with `--path-as-is`

Summary: Using --path-as-is with a file:// URL skips normalization of .. segments allowing reading of any local file the process can access Affected version curl 8.15.0-DEV commit 2a9dfe275, June 27, 2025 on Kali Linux 2024.3, x8664 Steps To Reproduce: 1. bulild curl with debug and ASan: git clon...

Curl 8.13.0 < 8.14.1 DoS (CVE-2025-5399)

The version of Curl installed on the remote host is is missing security update. It is, therefore, affected by a denial of service vulnerability. - Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless...

CLSA-2025-1750785256 curl: Fix of CVE-2024-7264

CVE-2024-7264: fix out-of-bound read in GTime2str function...

CLSA-2025-1750784906 curl: Fix of CVE-2024-7264

CVE-2024-7264: fix out-of-bound read in GTime2str function...

June 24, 2025—KB5061087 (OS Build 19045.6036) Preview

None None...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2025-1043)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1043 advisory. When curl is asked to use HSTS, the expiry time for a subdomain mightoverwrite a parent domain's cache entry, making it end sooner or later thanotherwise intended. This affects curl using applications...

Medium: curl

Issue Overview: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform...