Lucene search
+L
CurlMost viewed

215 matches found

curl security advisories
curl security advisories
added 2017/06/14 8:00 a.m.19 views

URL file scheme drive letter buffer overflow

When libcurl is given either 1. a file: URL that does not use two slashes following the colon, or 2. is told that file is the default scheme to use for URLs without scheme ... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path...

5.3CVSS6.2AI score0.03046EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/12/21 8:00 a.m.19 views

Win CE Schannel cert name out of buffer read

curl's TLS server certificate checks are flawed on Windows CE. This vulnerability occurs in the verify certificate function when comparing a wildcard certificate name as returned by the Windows API function CertGetNameString to the hostname used to make the connection to the server. The pattern...

9.8CVSS8.4AI score0.01641EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.19 views

OOB write via unchecked multiplication

In libcurl's base64 encode function, the output buffer is allocated as follows without any checks on insize: malloc insize 4 / 3 + 4 On systems with 32-bit addresses in userspace e.g. x86, ARM, x32, the multiplication in the expression wraps around if insize is at least 1GB of data. If this...

7CVSS7AI score0.00659EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.19 views

curl_getdate read out of bounds

The curlgetdate converts a given date string into a numerical timestamp and it supports a range of different formats and possibilities to express a date and time. The underlying date parsing function is also used internally when parsing for example HTTP cookies possibly received from remote serve...

7.5CVSS7.3AI score0.0484EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.19 views

IDNA 2003 makes curl use wrong host

When curl is built with libidn to handle International Domain Names IDNA, it translates them to puny code for DNS resolving using the IDNA 2003 standard, while IDNA 2008 is the modern and up-to-date IDNA standard. This misalignment causes problems with for example domains using the German ß...

7.5CVSS7.2AI score0.04321EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.19 views

double free in krb5 code

In curl's implementation of the Kerberos authentication mechanism, the function readdata in security.c is used to fill the necessary krb5 structures. When reading one of the length fields from the socket, it fails to ensure that the length parameter passed to realloc is not set to 0. This would...

9.8CVSS7.1AI score0.04461EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2015/01/08 8:00 a.m.19 views

Secure Transport certificate check bypass

libcurl stores TLS Session IDs in its associated Session ID cache when it connects to TLS servers. In subsequent connects it reuses the entry in the cache to resume the TLS connection faster than when doing a full TLS handshake. The actual implementation for the Session ID caching varies dependin...

5.8CVSS7.1AI score0.01148EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2014/11/05 8:00 a.m.19 views

duphandle read out of bounds

libcurl's function curleasyduphandle has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. When doing an HTTP POST transfer with libcurl, you can use the CURLOPTCOPYPOSTFIELDS option to specify a memory area holding the data to send to the...

4.3CVSS7.3AI score0.05121EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2014/03/26 8:00 a.m.19 views

not verifying certs for TLS to IP address / Schannel

When asked to do a TLS connection HTTPS, FTPS, IMAPS, etc to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature whether it was signed by a trusted CA and validity whether the date was within the certificate's...

4CVSS5.5AI score0.02576EPSS
SaveExploits1Affected Software2
curl security advisories
curl security advisories
added 2012/01/24 8:00 a.m.19 views

URL sanitization vulnerability

curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs. When parsing URLs, libcurl's parser is liberal and only parses as little as possible and lets as much as possible through as long as it can figure out what to do. In...

7.5CVSS7.1AI score0.16117EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2026/09/02 8:00 a.m.18 views

Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

5.9AI score0.01162EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2026/09/02 8:00 a.m.18 views

secure cookie attribute bypass with tab

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

5.9AI score0.00684EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2026/09/02 8:00 a.m.18 views

wolfSSL CA-cache hit overrides callback

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...

5.9AI score0.00425EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2025/09/10 8:00 a.m.18 views

predictable WebSocket mask

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...

7.2AI score0.00499EPSS
SaveExploits0References1Affected Software2
curl security advisories
curl security advisories
added 2025/09/10 8:00 a.m.18 views

Out of bounds read for cookie path

A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same hostname, but using clear text HTTP using the same cookie set 3. The same cookie name is set - but with only a slash as path path="/". Since this site is not...

6.5AI score0.01395EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2024/11/06 8:00 a.m.18 views

HSTS subdomain overwrites parent cache entry

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with host...

6.5CVSS6.9AI score0.01987EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2023/10/11 8:00 a.m.18 views

cookie injection with none file

This flaw allows an attacker to intentionally inject cookies into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a...

3.7CVSS6.9AI score0.06208EPSS
SaveExploits0References1Affected Software2
curl security advisories
curl security advisories
added 2023/05/17 8:00 a.m.18 views

UAF in SSH sha256 fingerprint check

libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the now freed hash. This flaw risks inserting sensitive heap-based data into the error message...

7.5CVSS6.8AI score0.02489EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2023/03/20 8:00 a.m.18 views

FTP too eager connection reuse

libcurl would reuse a previously created FTP connection even when one or more options had been changed that could have made the effective user a different one, thus leading to doing the second transfer with the wrong credentials. libcurl keeps previously used connections in a connection pool for...

5.9CVSS6.6AI score0.01607EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2022/10/26 8:00 a.m.18 views

HTTP proxy double free

If curl is told to use an HTTP proxy for a transfer with a non-HTTPS URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of protocol through. An HTTP proxy might refuse this request HTTP proxies often only allow outgoing...

8.1CVSS7.2AI score0.03136EPSS
SaveExploits0References1Affected Software2
curl security advisories
curl security advisories
added 2022/10/26 8:00 a.m.18 views

.netrc parser out-of-bounds access

curl can be told to parse a .netrc file for credentials. If that file ends in a line with consecutive non-white space letters and no newline, curl could read past the end of the stack-based buffer, and if the read works, write a zero byte possibly beyond its boundary. This does in most cases caus...

6.5CVSS7.3AI score0.01812EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2022/05/11 8:00 a.m.18 views

TLS and SSH connection too eager reuse

libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and...

7.5CVSS6.6AI score0.0293EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2022/04/27 8:00 a.m.18 views

Bad local IPv6 connection reuse

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take the IPv6 address zone id into account which could lead to libcurl reusing the wrong connection...

7.5CVSS6.4AI score0.03154EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2019/09/11 8:00 a.m.18 views

TFTP small blocksize heap buffer overflow

libcurl contains a heap buffer overflow in the function tftpreceivepacket that receives data from a TFTP server. It can call recvfrom with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is controlled b...

9.8CVSS6.5AI score0.17939EPSS
SaveExploits0References1Affected Software2
curl security advisories
curl security advisories
added 2019/05/22 8:00 a.m.18 views

Integer overflows in URL parser

libcurl contains two integer overflows in the curlurlset function that if triggered, can lead to a too small buffer allocation and a subsequent heap buffer overflow. The flaws only exist on 32-bit architectures and require excessive string input lengths...

4.3CVSS5.6AI score0.04848EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2018/10/31 8:00 a.m.18 views

SASL password overflow via integer overflow

libcurl contains a buffer overrun in the SASL authentication code. The internal function Curlauthcreateplainmessage fails to correctly verify that the passed in lengths for name and password are not too long, then calculates a buffer size to allocate. On systems with a 32-bit sizet, the math to...

9.8CVSS7.2AI score0.047EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2018/09/05 8:00 a.m.18 views

NTLM password overflow via integer overflow

libcurl contains a buffer overrun in the NTLM authentication code. The internal function Curlntlmcoremknthash multiplies the length of the password by two SUM to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the...

10CVSS7.2AI score0.10956EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2018/03/14 8:00 a.m.18 views

FTP path trickery leads to NIL byte out of bounds write

curl can be fooled into writing a zero byte out of bounds. This bug can trigger when curl is told to work on an FTP URL, with the setting to only issue a single CWD command --ftp-method singlecwd or the libcurl alternative CURLOPTFTPFILEMETHOD. curl then URL-decodes the given path, calls strlen o...

9.8CVSS7.7AI score0.10888EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2018/01/24 8:00 a.m.18 views

HTTP/2 trailer out-of-bounds read

libcurl contains an out bounds read in code handling HTTP/2 trailers. It was reported that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once...

9.1CVSS8.2AI score0.03976EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2017/04/03 8:00 a.m.18 views

--write-out out of buffer read

There were two bugs in curl's parser for the command line option --write-out or -w for short that would skip the end of string zero byte if the string ended in a % percent or \ backslash, and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that...

2.4CVSS6.5AI score0.00583EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.18 views

cookie injection for other servers

If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. The issue pertains to the function that loads cookies into memory, which reads the specified file...

7.5CVSS7.4AI score0.04756EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.18 views

URL unescape heap overflow via integer truncation

The URL percent-encoding decode function in libcurl is called curleasyunescape. Internally, even if this function would be made to allocate a destination buffer larger than 2GB, it would return that new length in a signed 32-bit integer variable, thus the length would get either truncated only or...

9.8CVSS7AI score0.04176EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.18 views

glob parser write/read out of bounds

The curl tool's "globbing" feature allows a user to specify a numerical range through which curl iterates. It is typically specified as 1-5, specifying the first and the last numbers in the range. Or with a-z, using letters. 1. The curl code for parsing the second unsigned number did not check fo...

9.8CVSS7.7AI score0.04153EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/11/02 8:00 a.m.18 views

invalid URL parsing with '#'

curl does not parse the authority component of the URL correctly when the host name part ends with a hash character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use a URL parser that follows the RFC to check for allowed...

7.5CVSS7.3AI score0.06253EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/09/07 8:00 a.m.18 views

Incorrect reuse of client certificates

libcurl built on top of NSS Network Security Services incorrectly reused client certificates if a certificate from file was used for one TLS connection but no certificate set for a subsequent TLS connection. While the symptoms are similar to CVE-2016-5420 Reusing connection with wrong client cert...

7.5CVSS6.5AI score0.07718EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/08/03 8:00 a.m.18 views

use of connection struct after free

libcurl is vulnerable to a use after free flaw. libcurl works with easy handles using the type 'CURL ' that are objects the application creates using curleasyinit. They are the handles that are all each associated with a single transfer at a time. libcurl also has an internal struct that represen...

8.1CVSS7.5AI score0.08037EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2016/01/27 8:00 a.m.18 views

NTLM credentials not-checked for proxy connection reuse

libcurl reuses NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. libcurl maintains a pool of connections after a transfer has completed. The pool of connections is then gone through when a ne...

7.3CVSS7.4AI score0.12255EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2014/09/10 8:00 a.m.18 views

cookie leak with IP address as domain

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application...

5CVSS7.3AI score0.07145EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2013/04/12 8:00 a.m.18 views

cookie domain tailmatch

libcurl is vulnerable to a cookie leak vulnerability when doing requests across domains with matching tails. When communicating over HTTPS and having libcurl's cookie engine enabled, libcurl stores and holds cookies for use when subsequent requests are done to hosts and paths that match those kep...

5CVSS7.3AI score0.04336EPSS
SaveExploits1Affected Software2
curl security advisories
curl security advisories
added 2010/10/13 8:00 a.m.18 views

local file overwrite

curl offers a command line option --remote-header-name also usable as -J which uses the filename of the Content-disposition: header when it saves the downloaded data locally. curl attempts to cut off the directory parts from any given filename in the header to only store files in the current...

5.8CVSS5.3AI score0.01715EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2010/02/09 8:00 a.m.18 views

data callback excessive length

When downloading data, libcurl hands it over to the application using a callback that is registered by the client software. libcurl then calls that function repeatedly with data until the transfer is complete. The callback is documented to receive a maximum data size of 16K CURLMAXWRITESIZE. Usin...

6.8CVSS7.5AI score0.03656EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2009/03/03 8:00 a.m.18 views

Arbitrary File Access

When told to follow a "redirect" automatically, libcurl does not question the new target URL but follows it to any new URL that it understands. As libcurl supports FILE:// URLs, a rogue server can thus "trick" a libcurl-using application to read a local file instead of the remote one. This is a...

6.8CVSS7.2AI score0.0905EPSS
SaveExploits3Affected Software2
curl security advisories
curl security advisories
added 2005/10/13 8:00 a.m.18 views

NTLM Buffer Overflow

libcurl's NTLM function can overflow a stack-based buffer if given a too long username or domain name. This would happen if you enable NTLM authentication and either: A - pass in a username and domain name to libcurl that together are longer than 192 bytes B - allow libcurl to follow HTTP...

7.5CVSS5.6AI score0.05188EPSS
SaveExploits0Affected Software2
curl security advisories
curl security advisories
added 2026/09/02 8:00 a.m.17 views

HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

5.8AI score0.00897EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2026/09/02 8:00 a.m.17 views

OpenSSL provider use-after-free

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

5.9AI score0.00899EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2026/03/11 8:00 a.m.17 views

use after free in SMB connection reuse

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...

7.2AI score0.00745EPSS
SaveExploits2References1Affected Software2
curl security advisories
curl security advisories
added 2024/03/27 8:00 a.m.17 views

QUIC certificate check bypass with wolfSSL

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems...

6.3CVSS6.6AI score0.01709EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2022/06/27 8:00 a.m.17 views

Non-preserved file permissions

When curl saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target filename. In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated...

9.8CVSS7.1AI score0.07321EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2022/06/27 8:00 a.m.17 views

HTTP compression denial of service

curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited...

6.5CVSS7.1AI score0.3216EPSS
SaveExploits1References1Affected Software2
curl security advisories
curl security advisories
added 2022/05/11 8:00 a.m.17 views

HSTS bypass via trailing dot

curl's HSTS check could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This mechanism could be bypassed if the hostname in the given URL used ...

4.3CVSS6.4AI score0.01262EPSS
SaveExploits1References1Affected Software2
Total number of security vulnerabilities215