curl / Docs / Vulnerability table / 7.78.0 vulnerabilities

Vulnerabilities in curl 7.78.0

curl version 7.78.0 was released on July 21 2021. The following 34 security problems are known to exist in this version.

FlawFrom versionTo and including
HTTP/2 push headers memory-leak7.
cookie mixed case PSL bypass7.
cookie injection with none file7.
SOCKS5 heap buffer overflow7.
more POST-after-PUT confusion7.78.0.1
IDN wildcard match7.
siglongjmp race condition7.
SSH connection too eager reuse still7.
GSS delegation too eager connection re-use7.
FTP too eager connection reuse7.
SFTP path ~ resolving discrepancy7.
TELNET option IAC injection7.77.88.1
HTTP multi-header compression denial of service7.
HSTS amnesia with --parallel7.
HSTS ignored on multiple requests7.
HTTP Proxy deny use after free7.
Another HSTS bypass via IDN7.
HSTS bypass via IDN7.
HTTP proxy double free7.
POST following PUT confusion7.77.85.0
control code in cookie denial of service4.97.84.0
FTP-KRB bad message verification7.
Non-preserved file permissions7.
HTTP compression denial of service7.
Set-Cookie denial of service7.
TLS and SSH connection too eager reuse7.
CERTINFO never-ending busy-loop7.
Auth/cookie leak on redirect4.97.82.0
Bad local IPv6 connection reuse7.
Credential leak on redirect4.97.82.0
OAUTH2 bearer bypass in connection re-use7.
STARTTLS protocol injection via MITM7.
Protocol downgrade required TLS bypassed7.
UAF and double free in MQTT sending7.

CVE data for 7.78.0 provided as JSON.

Changelog for curl 7.78.0

See vulnerability summary for the previous release: 7.77.0 or the subsequent release: 7.79.0