curl / Docs / curl CVEs / Bogus report filed by anonymous


Bogus report filed by anonymous

Project curl Security Dismissal, August 26 2023 - Permalink


None. CVE-2020-19909 was filed and made public by an anonymous person due to incompetence or malice. We cannot say which and the distinction does not matter to us.

The original description says:

"Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via crafted value as the retry delay."


We requested MITRE to reject the CVE on the basis that it is not a security vulnerability. MITRE, in their infinite wisdom, denied the rejection with the following motivation:

"After review there are multiple perspectives on whether the issue information is helpful to consumers of the CVE List, our current preference is in the direction of keeping the CVE ID assignment. There is a valid weakness (integer overflow) that can lead to a valid security impact (denial of service, based on retrying network traffic much more often than is documented/requested). The record has been flagged as DISPUTED and the views have been recorded as a NOTE in the record as well. This request will now be closed."


CVE-2020-19909 was filed on August 22 2023. Its existence was reported to us on August 25.

The issue was initially reported to the curl security team and determined not a security vulnerability, on July 27 2019. It was determined to be a "plain bug".

The bug was fixed on July 29, 2019.

The bugfix was shipped in curl 7.66.0. Released on September 11, 2019.


It does not affect any version. It is not a security problem. It was a bug that we fixed in mid 2019.


Relax. Use curl as usual.


Do not blindly trust the CVE system. It is full of cracks and bogus reports such as CVE-2020-19909.


This CVE was made public on August 22 2023. We were notified about it on August 25. Daniel wrote an explanatory blog post early August 26.


Thanks a lot!