CVE-2023-38545

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxyhandshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allowthat to resolve the address instead of it getting done by curl itself, themaximum length that host name can be is 255 bytes. If the host name is...

CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running programusing libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles"that are the individual handles for single transfers. libcurl provides a function ca...

CVE-2022-43552

A use after free vulnerability exists in curl

CVE-2023-23916

An allocation of resources without limits or throttling vulnerability exists in curl

CVE-2023-23914

A cleartext transmission of sensitive information vulnerability exists in curl

CVE-2023-46218

This flaw allows a malicious HTTP server to set "super cookies" in curl thatare then passed back to more origins than what is otherwise allowed orpossible. This allows a site to set cookies that then would get sent todifferent and unrelated sites and domains. It could do this by exploiting a mixed ...

CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so thatthey can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it wouldaccept in a response, allowing a malicious server to stream an endless seriesof headers and...

CVE-2023-23915

A cleartext transmission of sensitive information vulnerability exists in curl

CVE-2023-28322

An information disclosure vulnerability exists in curl

CVE-2023-46219

When saving HSTS data to an excessively long file name, curl could end upremoving all contents, making subsequent requests using that file unaware ofthe HSTS status they should otherwise use.

CVE-2023-27534

A path traversal vulnerability exists in curl

CVE-2023-28321

An improper certificate validation vulnerability exists in curl

CVE-2023-28319

A use after free vulnerability exists in curl

CVE-2023-27536

An authentication bypass vulnerability exists libcurl

CVE-2023-27535

An authentication bypass vulnerability exists in libcurl

CVE-2023-27533

A vulnerability in input validation exists in curl

CVE-2023-27538

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent ...

CVE-2023-28320

A denial of service vulnerability exists in curl

CVE-2023-27537

A double free vulnerability exists in libcurl