12788 matches found
Internet Bug Bounty: CVE-2025-0725: Heap overflow in curl with Content-Encoding gzip and old libz versions
A vulnerability was reported in the curl project, where a heap overflow could be triggered by a malicious HTTP server serving abnormally large gzip headers. The vulnerability was caused by an integer overflow in curl's support for old libz versions when the Content-Encoding: gzip header was used...
AZL-56692 CVE-2025-0665 affecting package curl for versions less than 8.11.1-3
libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve...
AZL-56478 CVE-2025-0167 affecting package curl for versions less than 8.8.0-6
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
AZL-56501 CVE-2025-0167 affecting package curl for versions less than 8.11.1-3
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
AZL-56504 CVE-2025-0725 affecting package curl for versions less than 8.11.1-3
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPTACCEPTENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow...
ALPINE-CVE-2025-0167
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
DEBIAN-CVE-2025-0665
libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve...
DEBIAN-CVE-2025-0167
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0665 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0725 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0167 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0167 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0665 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0725 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0167
The curl package is vulnerable to a flaw where it could leak a password from a .netrc file to a followed-to host during HTTP redirects. This specific issue occurs only when the .netrc file contains a default entry that omits both the login and password, which is a rare circumstance. Impacted envi...
CVE-2025-0167 netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167 netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167 netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167
When asked to use a ".netrc" file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a "default" entry that omits both login and password. A...