curl / Docs / Releases / curl CVEs

curl CVEs

If you find or simply suspect a security problem in curl or libcurl, please file a detailed report on our hackerone page and tell.

We appreciate getting notified in advance before you go public with security advisories for the sake of our users. We disclose security vulnerabilities in association with our fixes for them.

See also the Vulnerabilities Table to see what versions that are vulnerable to what flaws.

Alert: if you look up curl CVEs in public sources like NVD you will find they use inflated severity levels and CVSS scores. They think they know better and override our assessments. This is a systemic error that we unfortunately cannot fix. Feel free to complain to them - we keep doing it to no use - and consider using our material as the canonical sources for curl issues.

Past security audits

Cure 53 performed a security audit in August 2016.

Trail of Bits performed a security audit of curl source code and internals, published on December 21, 2022. See Threat Model Report & Fix Review and Code Review & Testing Analysis.

Past vulnerabilities

All | Medium+ | High+ | Critical

#	S	W	Vulnerability	Date	First	Last
103	H		CVE-2021-22901: TLS session caching disaster	2021-05-26	7.75.0	7.76.1
90	H		CVE-2019-5443: Windows OpenSSL engine code injection	2019-06-24	7.44.0	7.65.1
86	H		CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow	2019-02-06	7.36.0	7.63.0
81	H		CVE-2018-14618: NTLM password overflow via integer overflow	2018-09-05	7.15.4	7.61.0
80	H		CVE-2018-0500: SMTP send heap buffer overflow	2018-07-11	7.54.1	7.60.0
79	H		CVE-2018-1000300: FTP shutdown response buffer overflow	2018-05-16	7.54.1	7.59.0
75	H		CVE-2018-1000120: FTP path trickery leads to NIL byte out of bounds write	2018-03-14	7.12.3	7.58.0
72	H		CVE-2017-8818: SSL out of buffer access	2017-11-29	7.56.0	7.56.1
66	H		CVE-2017-1000100: TFTP sends more than buffer size	2017-08-09	7.15.0	7.54.1
64	H		CVE-2017-9502: URL file scheme drive letter buffer overflow	2017-06-14	7.53.0	7.54.0
63	H		CVE-2017-7468: TLS session resumption client cert bypass (again)	2017-04-19	7.52.0	7.53.1
60	H		CVE-2016-9594: uninitialized random	2016-12-23	7.52.0	7.52.0
56	H		CVE-2016-8615: cookie injection for other servers	2016-11-02	4.9	7.50.3
52	H		CVE-2016-8619: double free in krb5 code	2016-11-02	7.3	7.50.3
48	H	lib	CVE-2016-8623: Use after free via shared cookies	2016-11-02	7.10.7	7.50.3
46	H		CVE-2016-8625: IDNA 2003 makes curl use wrong host	2016-11-02	7.12.0	7.50.3
44	H		CVE-2016-7141: Incorrect reuse of client certificates	2016-09-07	7.19.6	7.50.1
43	H		CVE-2016-5419: TLS session resumption client cert bypass	2016-08-03	5.0	7.50.0
41	H	lib	CVE-2016-5421: use of connection struct after free	2016-08-03	7.32.0	7.50.0
40	H		CVE-2016-4802: Windows DLL hijacking	2016-05-30	7.11.1	7.49.0
39	H		CVE-2016-3739: TLS certificate check bypass with mbedTLS/PolarSSL	2016-05-18	7.21.0	7.48.0
38	H	tool	CVE-2016-0754: remote file name path traversal in curl tool for Windows	2016-01-27	4.0	7.46.0
36	H		CVE-2015-3237: SMB send off unrelated memory contents	2015-06-17	7.40.0	7.42.1
35	H		CVE-2015-3236: lingering HTTP credentials in connection re-use	2015-06-17	7.40.0	7.42.1
34	H		CVE-2015-3153: sensitive HTTP server headers also sent to proxies	2015-04-29	4.0	7.42.0
28	H		CVE-2014-8150: URL request injection	2015-01-08	6.0	7.39.0
26	H		CVE-2014-3620: cookie leak for TLDs	2014-09-10	7.31.0	7.37.1
17	H	lib	CVE-2013-2174: URL decode buffer boundary flaw	2013-06-22	7.7	7.30.0
16	H		CVE-2013-1944: cookie domain tailmatch	2013-04-12	4.7	7.29.0
15	C		CVE-2013-0249: SASL buffer overflow	2013-02-06	7.26.0	7.28.1
14	H		CVE-2011-3389: SSL CBC IV vulnerability	2012-01-24	7.10.6	7.23.1
13	H		CVE-2012-0036: URL sanitization vulnerability	2012-01-24	7.20.0	7.23.1
11	H	tool	CVE-2010-3842: local file overwrite	2010-10-13	7.20.0	7.21.1
10	H	lib	CVE-2010-0734: data callback excessive length	2010-02-09	7.10.5	7.19.7
9	H		CVE-2009-2417: embedded zero in cert name	2009-08-12	7.4	7.19.5
6	H		CVE-2006-1061: TFTP Packet Buffer Overflow	2006-03-20	7.15.0	7.15.2
5	H		CVE-2005-4077: URL Buffer Overflow	2005-12-07	7.11.2	7.15.0
4	H		CVE-2005-3185: NTLM Buffer Overflow	2005-10-13	7.10.6	7.14.1
3	H		CVE-2005-0490: Authentication Buffer Overflows	2005-02-21	7.3	7.13.0
2	H		CVE-2003-1605: Proxy Authentication Header Information Leakage	2003-08-03	4.5	7.10.6
1	C		CVE-2000-0973: FTP Server Response Buffer Overflow	2000-10-13	6.0	7.4

Retracted security vulnerabilities

Issues no longer considered curl security problems:

CVE-2019-15601 - SMB access smuggling via FILE URL on Windows
CVE-2023-32001 - fopen race condition

Bogus security vulnerabilities

Issues filed by others that are plain lies:

CVE-2020-19909

curl vulnerability data

vuln.csv and vuln.json provide info about all vulnerabilities in machine friendly formats.

Each vulnerability is also provided as a single JSON that you can access at "https://curl.se/docs/$CVE.json" - replace $CVE with the actual curl CVE Id.