curl / Docs / Vulnerability table / 7.6 vulnerabilities

Vulnerabilities in curl 7.6

curl version 7.6 was released on January 26 2001. The following 22 security problems are known to exist in this version.

Flaw	From version	To and including	CVE	CWE
control code in cookie denial of service	4.9	7.84.0	CVE-2022-35252	CWE-1286: Improper Validation of Syntactic Correctness of Input
Auth/cookie leak on redirect	4.9	7.82.0	CVE-2022-27776	CWE-522: Insufficiently Protected Credentials
Credential leak on redirect	4.9	7.82.0	CVE-2022-27774	CWE-522: Insufficiently Protected Credentials
Automatic referer leaks credentials	7.1.1	7.75.0	CVE-2021-22876	CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
trusting FTP PASV responses	4.0	7.73.0	CVE-2020-8284	CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
HTTP authentication leak in redirects	6.0	7.57.0	CVE-2018-1000007	CWE-522: Insufficiently Protected Credentials
--write-out out of buffer read	6.5	7.53.1	CVE-2017-7407	CWE-126: Buffer Over-read
printf floating point buffer overflow	5.4	7.51.0	CVE-2016-9586	CWE-121: Stack-based Buffer Overflow
cookie injection for other servers	4.9	7.50.3	CVE-2016-8615	CWE-187: Partial Comparison
OOB write via unchecked multiplication	7.3	7.50.3	CVE-2016-8617	CWE-131: Incorrect Calculation of Buffer Size
double-free in curl_maprintf	5.4	7.50.3	CVE-2016-8618	CWE-415: Double Free
double-free in krb5 code	7.3	7.50.3	CVE-2016-8619	CWE-415: Double Free
invalid URL parsing with '#'	6.0	7.50.3	CVE-2016-8624	CWE-172: Encoding Error
TLS session resumption client cert bypass	5.0	7.50.0	CVE-2016-5419	CWE-305: Authentication Bypass by Primary Weakness
sensitive HTTP server headers also sent to proxies	4.0	7.42.0	CVE-2015-3153	CWE-201: Information Exposure Through Sent Data
URL request injection	6.0	7.39.0	CVE-2014-8150	CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
cookie leak with IP address as domain	4.0	7.37.1	CVE-2014-3613	CWE-201: Information Exposure Through Sent Data
cookie domain tailmatch	6.0	7.29.0	CVE-2013-1944	CWE-201: Information Exposure Through Sent Data
embedded zero in cert name	7.4	7.19.5	CVE-2009-2417	CWE-170: Improper Null Termination
Arbitrary File Access	6.0	7.19.3	CVE-2009-0037	CWE-142: Improper Neutralization of Value Delimiters
Authentication Buffer Overflows	7.3	7.13.0	CVE-2005-0490	CWE-121: Stack-based Buffer Overflow
Proxy Authentication Header Information Leakage	4.5	7.10.6	CVE-2003-1605	CWE-201: Information Exposure Through Sent Data

Changelog for curl 7.6

See vulnerability summary for the previous release: 7.5.2 or the subsequent release: 7.6.1