[ { "schema_version": "1.5.0", "id": "CURL-CVE-2025-15224", "aliases": [ "CVE-2025-15224" ], "summary": "libssh key passphrase bypass without agent set", "modified": "2026-01-07T07:59:34.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2025-15224.json", "www": "https://curl.se/docs/CVE-2025-15224.html", "issue": "https://hackerone.com/reports/3480925", "CWE": { "id": "CWE-287", "desc": "Improper Authentication" }, "award": { "amount": "505", "currency": "USD" }, "last_affected": "8.17.0", "severity": "Low" }, "published": "2026-01-07T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.58.0"}, {"fixed": "8.18.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "c92d2e14cfb0db662f958effd2ac86f995cf1b5a"}, {"fixed": "16d5f2a5660c61cc27bd5f1c7f512391d1c927aa"} ] } ], "versions": [ "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Harry Sintonen", "type": "REMEDIATION_DEVELOPER" } ], "details": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2025-15079", "aliases": [ "CVE-2025-15079" ], "summary": "libssh global known_hosts override", "modified": "2026-01-07T14:25:14.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2025-15079.json", "www": "https://curl.se/docs/CVE-2025-15079.html", "issue": "https://hackerone.com/reports/3477116", "CWE": { "id": "CWE-297", "desc": "Improper Validation of Certificate with Host Mismatch" }, "award": { "amount": "505", "currency": "USD" }, "last_affected": "8.17.0", "severity": "Low" }, "published": "2026-01-07T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.58.0"}, {"fixed": "8.18.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "c92d2e14cfb0db662f958effd2ac86f995cf1b5a"}, {"fixed": "adca486c125d9a6d9565b9607a19dce803a8b479"} ] } ], "versions": [ "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2025-14524", "aliases": [ "CVE-2025-14524" ], "summary": "bearer token leak on cross-protocol redirect", "modified": "2026-01-07T14:25:14.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2025-14524.json", "www": "https://curl.se/docs/CVE-2025-14524.html", "issue": "https://hackerone.com/reports/3459417", "CWE": { "id": "CWE-522", "desc": "Insufficiently Protected Credentials" }, "award": { "amount": "505", "currency": "USD" }, "last_affected": "8.17.0", "severity": "Low" }, "published": "2026-01-06T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.33.0"}, {"fixed": "8.18.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa"}, {"fixed": "1a822275d333dc6da6043497160fd04c8fa48640"} ] } ], "versions": [ "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0" ] } ], "credits": [ { "name": "anonymous237 on hackerone", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2025-14017", "aliases": [ "CVE-2025-14017" ], "summary": "broken TLS options for threaded LDAPS", "modified": "2026-01-07T14:25:14.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2025-14017.json", "www": "https://curl.se/docs/CVE-2025-14017.html", "CWE": { "id": "CWE-567", "desc": "Unsynchronized Access to Shared Data in a Multi-threaded Context" }, "award": { "amount": "2540", "currency": "USD" }, "last_affected": "8.17.0", "severity": "Medium" }, "published": "2026-01-07T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.17.0"}, {"fixed": "8.18.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ccba0d10b6baf5c73cae8cf4fb3f29f0f55c5a34"}, {"fixed": "39d1976b7f709a516e3243338ebc0443bdd8d56d"} ] } ], "versions": [ "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2025-10966", "aliases": [ "CVE-2025-10966" ], "summary": "missing SFTP host verification with wolfSSH", "modified": "2025-11-11T11:36:34.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2025-10966.json", "www": "https://curl.se/docs/CVE-2025-10966.html", "issue": "https://hackerone.com/reports/3355218", "CWE": { "id": "CWE-322", "desc": "Key Exchange without Entity Authentication" }, "award": { "amount": "505", "currency": "USD" }, "last_affected": "8.16.0", "severity": "Low" }, "published": "2025-11-05T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.69.0"}, {"fixed": "8.17.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "6773c7ca65cf2183295e56603f9b86a5ce816a06"}, {"fixed": "b011e3fcfb06d6c0278595ee2ee297036fbe9793"} ] } ], "versions": [ "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2025-0725", "aliases": [ "CVE-2025-0725" ], "summary": "gzip integer overflow", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2025-0725.json", "www": "https://curl.se/docs/CVE-2025-0725.html", "issue": "https://hackerone.com/reports/2956023", "CWE": { "id": "CWE-680", "desc": "Integer Overflow to Buffer Overflow" }, "award": { "amount": "505", "currency": "USD" }, "last_affected": "8.11.1", "severity": "Low" }, "published": "2025-02-05T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.10.5"}, {"fixed": "8.12.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "019c4088cfcca0d2b7c5cc4f52ca5dac0c616089"}, {"fixed": "76f83f0db23846e254d940ec7fe141010077eb88"} ] } ], "versions": [ "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5" ] } ], "credits": [ { "name": "z2_", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2025-0167", "aliases": [ "CVE-2025-0167" ], "summary": "netrc and default credential leak", "modified": "2025-11-05T13:56:14.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2025-0167.json", "www": "https://curl.se/docs/CVE-2025-0167.html", "issue": "https://hackerone.com/reports/2917232", "CWE": { "id": "CWE-200", "desc": "Exposure of Sensitive Information to an Unauthorized Actor" }, "award": { "amount": "505", "currency": "USD" }, "last_affected": "8.11.1", "severity": "Low" }, "published": "2025-02-05T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.76.0"}, {"fixed": "8.12.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "46620b97431e19c53ce82e55055c85830f088cf4"}, {"fixed": "0e120c5b925e8ca75d5319e319e5ce4b8080d8eb"} ] } ], "versions": [ "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0" ] } ], "credits": [ { "name": "Yihang Zhou", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When asked to use a `.netrc` file for credentials **and** to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has a `default` entry that\nomits both login and password. A rare circumstance." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2024-11053", "aliases": [ "CVE-2024-11053" ], "summary": "netrc and redirect credential leak", "modified": "2025-11-05T13:56:14.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2024-11053.json", "www": "https://curl.se/docs/CVE-2024-11053.html", "issue": "https://hackerone.com/reports/2829063", "CWE": { "id": "CWE-200", "desc": "Exposure of Sensitive Information to an Unauthorized Actor" }, "award": { "amount": "505", "currency": "USD" }, "last_affected": "8.11.0", "severity": "Low" }, "published": "2024-12-11T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.76.0"}, {"fixed": "8.11.1"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "46620b97431e19c53ce82e55055c85830f088cf4"}, {"fixed": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949"} ] } ], "versions": [ "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2024-9681", "aliases": [ "CVE-2024-9681" ], "summary": "HSTS subdomain overwrites parent cache entry", "modified": "2024-11-07T23:43:58.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2024-9681.json", "www": "https://curl.se/docs/CVE-2024-9681.html", "issue": "https://hackerone.com/reports/2764830", "CWE": { "id": "CWE-1025", "desc": "Comparison Using Wrong Factors" }, "award": { "amount": "540", "currency": "USD" }, "last_affected": "8.10.1", "severity": "Low" }, "published": "2024-11-05T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.74.0"}, {"fixed": "8.11.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "7385610d0c74c6a254fea5e4cd6e1d559d848c8c"}, {"fixed": "a94973805df96269bf3f3bf0a20ccb9887313316"} ] } ], "versions": [ "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0" ] } ], "credits": [ { "name": "newfunction", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2024-8096", "aliases": [ "CVE-2024-8096" ], "summary": "OCSP stapling bypass with GnuTLS", "modified": "2024-10-24T18:05:41.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2024-8096.json", "www": "https://curl.se/docs/CVE-2024-8096.html", "issue": "https://hackerone.com/reports/2669852", "CWE": { "id": "CWE-295", "desc": "Improper Certificate Validation" }, "award": { "amount": "2540", "currency": "USD" }, "last_affected": "8.9.1", "severity": "Medium" }, "published": "2024-09-11T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.41.0"}, {"fixed": "8.10.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "f13669a375f5bfd14797bda91642cabe076974fa"}, {"fixed": "aeb1a281cab13c7ba791cb104e556b20e713941f"} ] } ], "versions": [ "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0" ] } ], "credits": [ { "name": "Hiroki Kurosawa", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When curl is told to use the Certificate Status Request TLS extension, often\nreferred to as OCSP stapling, to verify that the server certificate is valid,\nit might fail to detect some OCSP problems and instead wrongly consider the\nresponse as fine.\n\nIf the returned status reports another error than \"revoked\" (like for example\n\"unauthorized\") it is not treated as a bad certificate." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2024-7264", "aliases": [ "CVE-2024-7264" ], "summary": "ASN.1 date parser overread", "modified": "2024-07-31T09:57:12.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2024-7264.json", "www": "https://curl.se/docs/CVE-2024-7264.html", "issue": "https://hackerone.com/reports/2629968", "CWE": { "id": "CWE-125", "desc": "Out-of-bounds Read" }, "award": { "amount": "540", "currency": "USD" }, "last_affected": "8.9.0", "severity": "Low" }, "published": "2024-07-31T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.32.0"}, {"fixed": "8.9.1"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "3a24cb7bc456366cbc3a03f7ab6d2576105a1f2d"}, {"fixed": "27959ecce75cdb2809c0bdb3286e60e08fadb519"} ] } ], "versions": [ "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0" ] } ], "credits": [ { "name": "Dov Murik (Transmit Security)", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2024-2398", "aliases": [ "CVE-2024-2398" ], "summary": "HTTP/2 push headers memory-leak", "modified": "2024-03-26T10:36:00.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2024-2398.json", "www": "https://curl.se/docs/CVE-2024-2398.html", "issue": "https://hackerone.com/reports/2402845", "CWE": { "id": "CWE-772", "desc": "Missing Release of Resource after Effective Lifetime" }, "award": { "amount": "2540", "currency": "USD" }, "last_affected": "8.6.0", "severity": "Medium" }, "published": "2024-03-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.44.0"}, {"fixed": "8.7.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ea7134ac874a66107e54ff93657ac565cf2ec4aa"}, {"fixed": "deca8039991886a559b67bcd6701db800a5cf764"} ] } ], "versions": [ "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0" ] } ], "credits": [ { "name": "w0x42 on hackerone", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "When an application tells libcurl it wants to allow HTTP/2 server push, and\nthe amount of received headers for the push surpasses the maximum allowed\nlimit (1000), libcurl aborts the server push. When aborting, libcurl\ninadvertently does not free all the previously allocated headers and instead\nleaks the memory.\n\nFurther, this error condition fails silently and is therefore not easily\ndetected by an application." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-46218", "aliases": [ "CVE-2023-46218" ], "summary": "cookie mixed case PSL bypass", "modified": "2024-01-12T23:40:27.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-46218.json", "www": "https://curl.se/docs/CVE-2023-46218.html", "issue": "https://hackerone.com/reports/2212193", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "award": { "amount": "2540", "currency": "USD" }, "last_affected": "8.4.0", "severity": "Medium" }, "published": "2023-12-06T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.46.0"}, {"fixed": "8.5.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465"}, {"fixed": "2b0994c29a721c91c572cff7808c572a24d251eb"} ] } ], "versions": [ "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a\nlowercase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL\ndomain." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-38546", "aliases": [ "CVE-2023-38546" ], "summary": "cookie injection with none file", "modified": "2024-07-02T09:22:24.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2023-38546.json", "www": "https://curl.se/docs/CVE-2023-38546.html", "issue": "https://hackerone.com/reports/2148242", "CWE": { "id": "CWE-73", "desc": "External Control of filename or Path" }, "award": { "amount": "540", "currency": "USD" }, "last_affected": "8.3.0", "severity": "Low" }, "published": "2023-10-11T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.9.1"}, {"fixed": "8.4.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "74d5a6fb3b9a96d9fa51ba90996e94c878ebd151"}, {"fixed": "61275672b46d9abb3285740467b882e22ed75da8"} ] } ], "versions": [ "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", "7.9.2", "7.9.1" ] } ], "credits": [ { "name": "w0x42 on hackerone", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "This flaw allows an attacker to intentionally inject cookies into a running\nprogram using libcurl, if the specific series of conditions are met.\n\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\nthat are the individual handles for single transfers.\n\nlibcurl provides a function call that duplicates an easy handle called\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\n\nIf a transfer has cookies enabled when the handle is duplicated, the\ncookie-enable state is also cloned - but without cloning the actual\ncookies. If the source handle did not read any cookies from a specific file on\ndisk, the cloned version of the handle would instead store the filename as\n`none` (using the four ASCII letters, no quotes).\n\nSubsequent use of the cloned handle that does not explicitly set a source to\nload cookies from would then inadvertently load cookies from a file named\n`none` - if such a file exists and is readable in the current directory of the\nprogram using libcurl, when using the correct file format of course." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-38545", "aliases": [ "CVE-2023-38545" ], "summary": "SOCKS5 heap buffer overflow", "modified": "2023-11-19T16:44:33.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-38545.json", "www": "https://curl.se/docs/CVE-2023-38545.html", "issue": "https://hackerone.com/reports/2187833", "CWE": { "id": "CWE-122", "desc": "Heap-based Buffer Overflow" }, "award": { "amount": "4660", "currency": "USD" }, "last_affected": "8.3.0", "severity": "High" }, "published": "2023-10-11T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.69.0"}, {"fixed": "8.4.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "4a4b63daaa01ef59b131d91e8e6e6dfe275c0f08"}, {"fixed": "fb4415d8aee6c1045be932a34fe6107c2f5ed147"} ] } ], "versions": [ "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0" ] } ], "credits": [ { "name": "Jay Satiro", "type": "FINDER" }, { "name": "Jay Satiro", "type": "REMEDIATION_DEVELOPER" } ], "details": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the hostname to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that hostname can be is 255 bytes.\n\nIf the hostname is detected to be longer than 255 bytes, curl switches to\nlocal name resolving and instead passes on the resolved address only to the\nproxy. Due to a bug, the local variable that means \"let the host resolve the\nname\" could get the wrong value during a slow SOCKS5 handshake, and contrary\nto the intention, copy the too long hostname to the target buffer instead of\ncopying just the resolved address there." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-28322", "aliases": [ "CVE-2023-28322" ], "summary": "more POST-after-PUT confusion", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2023-28322.json", "www": "https://curl.se/docs/CVE-2023-28322.html", "issue": "https://hackerone.com/reports/1954658", "CWE": { "id": "CWE-440", "desc": "Expected Behavior Violation" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "8.0.1", "severity": "Low" }, "published": "2023-05-17T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.7"}, {"fixed": "8.1.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "546572da0457f37c698c02d0a08d90fdfcbeedec"}, {"fixed": "7815647d6582c0a4900be2e1de6c5e61272c496b"} ] } ], "versions": [ "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", "7.9.2", "7.9.1", "7.9", "7.8.1", "7.8", "7.7.3", "7.7.2", "7.7.1", "7.7" ] } ], "credits": [ { "name": "Hiroki Kurosawa", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When doing HTTP(S) transfers, libcurl might erroneously use the read callback\n(`CURLOPT_READFUNCTION`) to ask for data to send, even when the\n`CURLOPT_POSTFIELDS` option has been set, if the same handle previously was\nused to issue a `PUT` request which used that callback.\n\nThis flaw may surprise the application and cause it to misbehave and either\nsend off the wrong data or use memory after free or similar in the second\ntransfer.\n\nThe problem exists in the logic for a reused handle when it is (expected to\nbe) changed from a PUT to a POST." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-28321", "aliases": [ "CVE-2023-28321" ], "summary": "IDN wildcard match", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-28321.json", "www": "https://curl.se/docs/CVE-2023-28321.html", "issue": "https://hackerone.com/reports/1950627", "CWE": { "id": "CWE-295", "desc": "Improper Certificate Validation" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "8.0.1", "severity": "Low" }, "published": "2023-05-17T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.12.0"}, {"fixed": "8.1.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "9631fa740708b1890197fad01e25b34b7e8eb80e"}, {"fixed": "199f2d440d8659b42670c1b796220792b01a97bf"} ] } ], "versions": [ "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0" ] } ], "credits": [ { "name": "Hiroki Kurosawa", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl supports matching of wildcard patterns when listed as \"Subject\nAlternative Name\" in TLS server certificates. curl can be built to use its own\nname matching function for TLS rather than one provided by a TLS library. This\nprivate wildcard matching function would match IDN (International Domain Name)\nhosts incorrectly and could as a result accept patterns that otherwise should\nmismatch.\n\nIDN hostnames are converted to puny code before used for certificate\nchecks. Puny coded names always start with `xn--` and should not be allowed to\npattern match, but the wildcard check in curl could still check for `x*`,\nwhich would match even though the IDN name most likely contained nothing even\nresembling an `x`." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-28320", "aliases": [ "CVE-2023-28320" ], "summary": "siglongjmp race condition", "modified": "2025-11-12T00:50:45.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2023-28320.json", "www": "https://curl.se/docs/CVE-2023-28320.html", "issue": "https://hackerone.com/reports/1929597", "CWE": { "id": "CWE-662", "desc": "Improper Synchronization" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "8.0.1", "severity": "Low" }, "published": "2023-05-17T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.9.8"}, {"fixed": "8.1.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "3c49b405de4fbf1fd7127f91908261268640e54f"}, {"fixed": "13718030ad4b3209a7583b4f27f683cd3a6fa5f2"} ] } ], "versions": [ "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Harry Sintonen", "type": "REMEDIATION_DEVELOPER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl provides several different backends for resolving hostnames, selected\nat build time. If it is built to use the synchronous resolver, it allows name\nresolves to time-out slow operations using `alarm()` and `siglongjmp()`.\n\nWhen doing this, libcurl used a global buffer that was not mutex protected and\na multi-threaded application might therefore crash or otherwise misbehave." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-27538", "aliases": [ "CVE-2023-27538" ], "summary": "SSH connection too eager reuse still", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-27538.json", "www": "https://curl.se/docs/CVE-2023-27538.html", "issue": "https://hackerone.com/reports/1898475", "CWE": { "id": "CWE-305", "desc": "Authentication Bypass by Primary Weakness" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.88.1", "severity": "Low" }, "published": "2023-03-20T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.16.1"}, {"fixed": "8.0.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "2147284cad624325f5b0034c2f394db62086d9e6"}, {"fixed": "af369db4d3833272b8ed443f7fcc2e757a0872eb"} ] } ], "versions": [ "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl would reuse a previously created connection even when an SSH related\noption had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, two SSH settings\nwere left out from the configuration match checks, making them match too\neasily." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-27536", "aliases": [ "CVE-2023-27536" ], "summary": "GSS delegation too eager connection reuse", "modified": "2025-09-27T10:58:29.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2023-27536.json", "www": "https://curl.se/docs/CVE-2023-27536.html", "issue": "https://hackerone.com/reports/1895135", "CWE": { "id": "CWE-305", "desc": "Authentication Bypass by Primary Weakness" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.88.1", "severity": "Low" }, "published": "2023-03-20T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.22.0"}, {"fixed": "8.0.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ebf42c4be76df40ec6d3bf32f229bbb274e2c32f"}, {"fixed": "cb49e67303dbafbab1cebf4086e3ec15b7d56ee5"} ] } ], "versions": [ "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl would reuse a previously created connection even when the GSS\ndelegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could\nhave changed the user's permissions in a second transfer.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, this GSS\ndelegation setting was left out from the configuration match checks, making\nthem match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-27535", "aliases": [ "CVE-2023-27535" ], "summary": "FTP too eager connection reuse", "modified": "2025-11-12T00:50:45.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-27535.json", "www": "https://curl.se/docs/CVE-2023-27535.html", "issue": "https://hackerone.com/reports/1892780", "CWE": { "id": "CWE-305", "desc": "Authentication Bypass by Primary Weakness" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.88.1", "severity": "Medium" }, "published": "2023-03-20T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.13.0"}, {"fixed": "8.0.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "177dbc7be07125582ddb7416dba7140b88ab9f62"}, {"fixed": "8f4608468b890dce2dad9f91d5607ee7e9c1aba1"} ] } ], "versions": [ "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl would reuse a previously created FTP connection even when one or more\noptions had been changed that could have made the effective user a different\none, thus leading to doing the second transfer with the wrong credentials.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, several FTP\nsettings were left out from the configuration match checks, making them match\ntoo easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`,\n`CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL`\nlevel." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-27534", "aliases": [ "CVE-2023-27534" ], "summary": "SFTP path ~ resolving discrepancy", "modified": "2023-05-09T13:59:45.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-27534.json", "www": "https://curl.se/docs/CVE-2023-27534.html", "issue": "https://hackerone.com/reports/1892351", "CWE": { "id": "CWE-22", "desc": "Improper Limitation of a Pathname to a Restricted Directory" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.88.1", "severity": "Low" }, "published": "2023-03-20T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.18.0"}, {"fixed": "8.0.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ba6f20a2442ab1ebfe947cff19a552f92114a29a"}, {"fixed": "4e2b52b5f7a3bf50a0f1494155717b02cc1df6d6"} ] } ], "versions": [ "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl supports SFTP transfers. curl's SFTP implementation offers a special\nfeature in the path component of URLs: a tilde (`~`) character as the first\npath element in the path to denotes a path relative to the user's home\ndirectory. This is supported because of wording in the [once proposed\nto-become RFC\ndraft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04)\nthat was to dictate how SFTP URLs work.\n\nDue to a bug, the handling of the tilde in SFTP path did however not only\nreplace it when it is used stand-alone as the first path element but also\nwrongly when used as a mere prefix in the first element.\n\nUsing a path like `/~2/foo` when accessing a server using the user `dan` (with\nhome directory `/home/dan`) would then quite surprisingly access the file\n`/home/dan2/foo`.\n\nThis can be taken advantage of to circumvent filtering or worse." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-27533", "aliases": [ "CVE-2023-27533" ], "summary": "TELNET option IAC injection", "modified": "2024-06-07T13:53:51.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-27533.json", "www": "https://curl.se/docs/CVE-2023-27533.html", "issue": "https://hackerone.com/reports/1891474", "CWE": { "id": "CWE-75", "desc": "Failure to Sanitize Special Elements into a Different Plane" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.88.1", "severity": "Low" }, "published": "2023-03-20T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.7"}, {"fixed": "8.0.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4"}, {"fixed": "538b1e79a6e7b0bb829ab4cecc828d32105d0684"} ] } ], "versions": [ "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", "7.9.2", "7.9.1", "7.9", "7.8.1", "7.8", "7.7.3", "7.7.2", "7.7.1", "7.7" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl supports communicating using the TELNET protocol and as a part of this it\noffers users to pass on username and \"telnet options\" for the server\nnegotiation.\n\nDue to lack of proper input scrubbing and without it being the documented\nfunctionality, curl would pass on username and telnet options to the server\nas provided. This could allow users to pass in carefully crafted content that\npass on content or do option negotiation without the application intending to\ndo so. In particular if an application for example allows users to provide the\ndata or parts of the data." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-23916", "aliases": [ "CVE-2023-23916" ], "summary": "HTTP multi-header compression denial of service", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-23916.json", "www": "https://curl.se/docs/CVE-2023-23916.html", "issue": "https://hackerone.com/reports/1826048", "CWE": { "id": "CWE-770", "desc": "Allocation of Resources Without Limits or Throttling" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.87.0", "severity": "Medium" }, "published": "2023-02-15T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.57.0"}, {"fixed": "7.88.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "dbcced8e32b50c068ac297106f0502ee200a1ebd"}, {"fixed": "119fb187192a9ea13dc90d9d20c215fc82799ab9"} ] } ], "versions": [ "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0" ] } ], "credits": [ { "name": "Patrick Monnerat", "type": "FINDER" }, { "name": "Patrick Monnerat", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl supports \"chained\" HTTP compression algorithms, meaning that a server\nresponse can be compressed multiple times and potentially with different\nalgorithms. The number of acceptable \"links\" in this \"decompression chain\" was\ncapped, but the cap was implemented on a per-header basis allowing a malicious\nserver to insert a virtually unlimited number of compression steps simply by\nusing many headers.\n\nThe use of such a decompression chain could result in a \"malloc bomb\", making\ncurl end up spending enormous amounts of allocated heap memory, or trying to\nand returning out of memory errors." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-23915", "aliases": [ "CVE-2023-23915" ], "summary": "HSTS amnesia with --parallel", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-23915.json", "www": "https://curl.se/docs/CVE-2023-23915.html", "issue": "https://hackerone.com/reports/1814333", "CWE": { "id": "CWE-319", "desc": "Cleartext Transmission of Sensitive Information" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.87.0", "severity": "Low" }, "published": "2023-02-15T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.77.0"}, {"fixed": "7.88.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "7385610d0c74c6a254fea5e4cd6e1d559d848c8c"}, {"fixed": "076a2f629119222aeeb50f5a03bf9f9052fabb9a"} ] } ], "versions": [ "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl's HSTS cache saving behaves wrongly when multiple URLs are requested in\nparallel.\n\nUsing its HSTS support, curl can be instructed to use HTTPS instead of using\nan insecure clear-text HTTP step even when HTTP is provided in the URL. This\nHSTS mechanism would however surprisingly fail when multiple transfers are done\nin parallel as the HSTS cache file gets overwritten by the most recently\ncompleted transfer.\n\nA later HTTP-only transfer to the earlier hostname would then *not* get\nupgraded properly to HSTS.\n\nReproducible like this:\n\n1. `curl --hsts hsts.txt --parallel https://curl.se https://example.com`\n2. `curl --hsts hsts.txt http://curl.se`" }, { "schema_version": "1.5.0", "id": "CURL-CVE-2023-23914", "aliases": [ "CVE-2023-23914" ], "summary": "HSTS ignored on multiple requests", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2023-23914.json", "www": "https://curl.se/docs/CVE-2023-23914.html", "issue": "https://hackerone.com/reports/1813864", "CWE": { "id": "CWE-319", "desc": "Cleartext Transmission of Sensitive Information" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.87.0", "severity": "Low" }, "published": "2023-02-15T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.77.0"}, {"fixed": "7.88.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "7385610d0c74c6a254fea5e4cd6e1d559d848c8c"}, {"fixed": "076a2f629119222aeeb50f5a03bf9f9052fabb9a"} ] } ], "versions": [ "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl's HSTS functionality fail when multiple URLs are requested serially.\n\nUsing its HSTS support, curl can be instructed to use HTTPS instead of using\nan insecure clear-text HTTP step even when HTTP is provided in the URL. This\nHSTS mechanism would however surprisingly be ignored by subsequent transfers\nwhen done on the same command line because the state would not be properly\ncarried on.\n\nReproducible like this:\n\n curl --hsts \"\" https://curl.se http://curl.se\n\nThe first URL returns HSTS information that the second URL fails to take\nadvantage of." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-43552", "aliases": [ "CVE-2022-43552" ], "summary": "HTTP Proxy deny use after free", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-43552.json", "www": "https://curl.se/docs/CVE-2022-43552.html", "issue": "https://hackerone.com/reports/1764858", "CWE": { "id": "CWE-416", "desc": "Use After Free" }, "last_affected": "7.86.0", "severity": "Low" }, "published": "2022-12-21T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.16.0"}, {"fixed": "7.87.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "b7eeb6e67fca686f840eacd6b8394edb58b07482"}, {"fixed": "4f20188ac644afe174be6005ef4f6ffba232b8b2"} ] } ], "versions": [ "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0" ] } ], "credits": [ { "name": "Trail of Bits", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl can be asked to *tunnel* virtually all protocols it supports through an\nHTTP proxy. HTTP proxies can (and often do) deny such tunnel operations using\nan appropriate HTTP error response code.\n\nWhen getting denied to tunnel the specific protocols SMB or TELNET, curl would\nuse a heap-allocated struct after it had been freed, in its transfer shutdown\ncode path." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-43551", "aliases": [ "CVE-2022-43551" ], "summary": "Another HSTS bypass via IDN", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-43551.json", "www": "https://curl.se/docs/CVE-2022-43551.html", "issue": "https://hackerone.com/reports/1755083", "CWE": { "id": "CWE-319", "desc": "Cleartext Transmission of Sensitive Information" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.86.0", "severity": "Medium" }, "published": "2022-12-21T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.77.0"}, {"fixed": "7.87.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "7385610d0c74c6a254fea5e4cd6e1d559d848c8c"}, {"fixed": "9e71901634e276dd050481c4320f046bebb1bc28"} ] } ], "versions": [ "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0" ] } ], "credits": [ { "name": "Hiroki Kurosawa", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl's HSTS check could be bypassed to trick it to keep using HTTP.\n\nUsing its HSTS support, curl can be instructed to use HTTPS instead of using\nan insecure clear-text HTTP step even when HTTP is provided in the URL.\n\nThe HSTS mechanism could be bypassed if the hostname in the given URL first\nuses IDN characters that get replaced to ASCII counterparts as part of the IDN\nconversion. Like using the character UTF-8 U+3002 (`IDEOGRAPHIC FULL STOP`)\ninstead of the common ASCII full stop (U+002E). Then in a subsequent request,\nit does not detect the HSTS state and makes a clear text transfer. Because it\nwould store the info IDN encoded but look for it IDN decoded.\n\nReproducible like this:\n\n curl --hsts hsts.txt https://curl%E3%80%82se\n curl --hsts hsts.txt http://curl%E3%80%82se" }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-42916", "aliases": [ "CVE-2022-42916" ], "summary": "HSTS bypass via IDN", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-42916.json", "www": "https://curl.se/docs/CVE-2022-42916.html", "issue": "https://hackerone.com/reports/1730660", "CWE": { "id": "CWE-319", "desc": "Cleartext Transmission of Sensitive Information" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.85.0", "severity": "Medium" }, "published": "2022-10-26T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.77.0"}, {"fixed": "7.86.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "7385610d0c74c6a254fea5e4cd6e1d559d848c8c"}, {"fixed": "53bcf55b4538067e6dc36242168866becb987bb7"} ] } ], "versions": [ "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0" ] } ], "credits": [ { "name": "Hiroki Kurosawa", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl's HSTS check could be bypassed to trick it to keep using HTTP.\n\nUsing its HSTS support, curl can be instructed to use HTTPS directly instead\nof using an insecure clear-text HTTP step even when HTTP is provided in the\nURL. This mechanism could be bypassed if the hostname in the given URL uses\nIDN characters that get replaced to ASCII counterparts as part of the IDN\nconversion. Like using the character UTF-8 U+3002 (`IDEOGRAPHIC FULL STOP`)\ninstead of the common ASCII full stop (U+002E) `.`.\n\nLike this: `http://curl。se。`" }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-42915", "aliases": [ "CVE-2022-42915" ], "summary": "HTTP proxy double free", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-42915.json", "www": "https://curl.se/docs/CVE-2022-42915.html", "issue": "https://hackerone.com/reports/1722065", "CWE": { "id": "CWE-415", "desc": "Double Free" }, "last_affected": "7.85.0", "severity": "Medium" }, "published": "2022-10-26T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.77.0"}, {"fixed": "7.86.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "51c0ebcff2140c38ff389b4fcfb8216f5e9d198c"}, {"fixed": "55e1875729f9d9fc7315cec611bffbd2c817ad89"} ] } ], "versions": [ "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0" ] } ], "credits": [ { "name": "Trail of Bits", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it\nsets up the connection to the remote server by issuing a `CONNECT` request to\nthe proxy, and then *tunnels* the rest of protocol through.\n\nAn HTTP proxy might refuse this request (HTTP proxies often only allow\noutgoing connections to specific port numbers, like 443 for HTTPS) and instead\nreturn a non-200 response code to the client.\n\nDue to flaws in the error/cleanup handling, this could trigger a double free\nin curl if one of the following schemes were used in the URL for the transfer:\n`dict`, `gopher`, `gophers`, `ldap`, `ldaps`, `rtmp`, `rtmps`, `telnet`" }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-32221", "aliases": [ "CVE-2022-32221" ], "summary": "POST following PUT confusion", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2022-32221.json", "www": "https://curl.se/docs/CVE-2022-32221.html", "issue": "https://hackerone.com/reports/1704017", "CWE": { "id": "CWE-440", "desc": "Expected Behavior Violation" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.85.0", "severity": "Medium" }, "published": "2022-10-26T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.7"}, {"fixed": "7.86.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "546572da0457f37c698c02d0a08d90fdfcbeedec"}, {"fixed": "a64e3e59938abd7d667e4470a18072a24d7e9de9"} ] } ], "versions": [ "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", "7.9.2", "7.9.1", "7.9", "7.8.1", "7.8", "7.7.3", "7.7.2", "7.7.1", "7.7" ] } ], "credits": [ { "name": "Robby Simpson", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When doing HTTP(S) transfers, libcurl might erroneously use the read callback\n(`CURLOPT_READFUNCTION`) to ask for data to send, even when the\n`CURLOPT_POSTFIELDS` option has been set, if the same handle previously was\nused to issue a `PUT` request which used that callback.\n\nThis flaw may surprise the application and cause it to misbehave and either\nsend off the wrong data or use memory after free or similar in the subsequent\n`POST` request.\n\nThe problem exists in the logic for a reused handle when it is changed from a\nPUT to a POST." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-35252", "aliases": [ "CVE-2022-35252" ], "summary": "control code in cookie denial of service", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-35252.json", "www": "https://curl.se/docs/CVE-2022-35252.html", "issue": "https://hackerone.com/reports/1613943", "CWE": { "id": "CWE-1286", "desc": "Improper Validation of Syntactic Correctness of Input" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.84.0", "severity": "Low" }, "published": "2022-08-31T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "4.9"}, {"fixed": "7.85.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ae1912cb0d494b48d514d937826c9fe83ec96c4d"}, {"fixed": "8dfc93e573ca740544a2d79ebb0ed786592c65c3"} ] } ], "versions": [ "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", "7.9.2", "7.9.1", "7.9", "7.8.1", "7.8", "7.7.3", "7.7.2", "7.7.1", "7.7", "7.6.1", "7.6", "7.5.2", "7.5.1", "7.5", "7.4.2", "7.4.1", "7.4", "7.3", "7.2.1", "7.2", "7.1.1", "7.1", "6.5.2", "6.5.1", "6.5", "6.4", "6.3.1", "6.3", "6.2", "6.1", "6.0", "5.11", "5.10", "5.9.1", "5.9", "5.8", "5.7.1", "5.7", "5.5.1", "5.5", "5.4", "5.3", "5.2.1", "5.2", "5.0", "4.10", "4.9" ] } ], "credits": [ { "name": "Axel Chong", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When curl retrieves and parses cookies from an HTTP(S) server, it accepts\ncookies using control codes (byte values below 32). When cookies that contain\nsuch control codes are later sent back to an HTTP(S) server, it might make the\nserver return a 400 response. Effectively allowing a \"sister site\" to deny\nservice to siblings." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-32208", "aliases": [ "CVE-2022-32208" ], "summary": "FTP-KRB bad message verification", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-32208.json", "www": "https://curl.se/docs/CVE-2022-32208.html", "issue": "https://hackerone.com/reports/1590071", "CWE": { "id": "CWE-924", "desc": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.83.1", "severity": "Low" }, "published": "2022-06-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.16.4"}, {"fixed": "7.84.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "54967d2a3ab5559631407f7b7f67ef48c2dda6dd"}, {"fixed": "6ecdf5136b52af747e7bda08db9a748256b1cd09"} ] } ], "versions": [ "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When curl does FTP transfers secured by krb5, it handles message verification\nfailures wrongly. This flaw makes it possible for a Man-In-The-Middle attack\nto go unnoticed and even allows it to inject data to the client." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-32207", "aliases": [ "CVE-2022-32207" ], "summary": "Non-preserved file permissions", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-32207.json", "www": "https://curl.se/docs/CVE-2022-32207.html", "issue": "https://hackerone.com/reports/1573634", "CWE": { "id": "CWE-281", "desc": "Improper Preservation of Permissions" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.83.1", "severity": "Medium" }, "published": "2022-06-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.69.0"}, {"fixed": "7.84.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "b834890a3fa3f525cd8ef4e99554cdb4558d7e1b"}, {"fixed": "20f9dd6bae50b7223171b17ba7798946e74f877f"} ] } ], "versions": [ "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When curl saves cookies, alt-svc and hsts data to local files, it makes the\noperation atomic by finalizing the operation with a rename from a temporary\nname to the final target filename.\n\nIn that rename operation, it might accidentally *widen* the permissions for\nthe target file, leaving the updated file accessible to more users than\nintended." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-32206", "aliases": [ "CVE-2022-32206" ], "summary": "HTTP compression denial of service", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-32206.json", "www": "https://curl.se/docs/CVE-2022-32206.html", "issue": "https://hackerone.com/reports/1570651", "CWE": { "id": "CWE-770", "desc": "Allocation of Resources Without Limits or Throttling" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.83.1", "severity": "Medium" }, "published": "2022-06-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.57.0"}, {"fixed": "7.84.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "dbcced8e32b50c068ac297106f0502ee200a1ebd"}, {"fixed": "3a09fbb7f264c67c438d01a30669ce325aa508e2"} ] } ], "versions": [ "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl supports \"chained\" HTTP compression algorithms, meaning that a server\nresponse can be compressed multiple times and potentially with different\nalgorithms. The number of acceptable \"links\" in this \"decompression chain\" was\nunbounded, allowing a malicious server to insert a virtually unlimited number\nof compression steps.\n\nThe use of such a decompression chain could result in a \"malloc bomb\", making\ncurl end up spending enormous amounts of allocated heap memory, or trying to\nand returning out of memory errors." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-32205", "aliases": [ "CVE-2022-32205" ], "summary": "Set-Cookie denial of service", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-32205.json", "www": "https://curl.se/docs/CVE-2022-32205.html", "issue": "https://hackerone.com/reports/1569946", "CWE": { "id": "CWE-770", "desc": "Allocation of Resources Without Limits or Throttling" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.83.1", "severity": "Low" }, "published": "2022-06-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.71.0"}, {"fixed": "7.84.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ed35d6590e72c23c568af1e3b8ac6e4e2d883888"}, {"fixed": "48d7064a49148f03942380967da739dcde1cdc24"} ] } ], "versions": [ "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "A malicious server can serve excessive amounts of `Set-Cookie:` headers in a\nHTTP response to curl and curl stores all of them. A sufficiently large amount\nof (big) cookies make subsequent HTTP requests to this, or other servers to\nwhich the cookies match, create requests that become larger than the threshold\nthat curl uses internally to avoid sending crazy large requests (1048576\nbytes) and instead returns an error.\n\nThis denial state might remain for as long as the same cookies are kept, match\nand have not expired. Due to cookie matching rules, a server on\n`foo.example.com` can set cookies that also would match for `bar.example.com`,\nmaking it it possible for a \"sister server\" to effectively cause a denial of\nservice for a sibling site on the same second level domain using this method." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-27782", "aliases": [ "CVE-2022-27782" ], "summary": "TLS and SSH connection too eager reuse", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-27782.json", "www": "https://curl.se/docs/CVE-2022-27782.html", "issue": "https://hackerone.com/reports/1555796", "CWE": { "id": "CWE-305", "desc": "Authentication Bypass by Primary Weakness" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.83.0", "severity": "Medium" }, "published": "2022-05-11T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.16.1"}, {"fixed": "7.83.1"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "2147284cad624325f5b0034c2f394db62086d9e6"}, {"fixed": "1645e9b44505abd5cbaf65da5282c3f33b5924a5"} ] } ], "versions": [ "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl would reuse a previously created connection even when a TLS or SSH\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, several TLS and\nSSH settings were left out from the configuration match checks, making them\nmatch too easily." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-27781", "aliases": [ "CVE-2022-27781" ], "summary": "CERTINFO never-ending busy-loop", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2022-27781.json", "www": "https://curl.se/docs/CVE-2022-27781.html", "issue": "https://hackerone.com/reports/1555441", "CWE": { "id": "CWE-835", "desc": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "last_affected": "7.83.0", "severity": "Low" }, "published": "2022-05-11T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.34.0"}, {"fixed": "7.83.1"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "f6c335d63f2da025a0a3efde1fe59e3bb7189b70"}, {"fixed": "5c7da89d404bf59c8dd82a001119a16d18365917"} ] } ], "versions": [ "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0" ] } ], "credits": [ { "name": "Florian Kohnhäuser", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl provides the `CURLOPT_CERTINFO` option to allow applications to\nrequest details to be returned about a TLS server's certificate chain.\n\nDue to an erroneous function, a malicious server could make libcurl built with\nNSS get stuck in a never-ending busy-loop when trying to retrieve that\ninformation." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-27776", "aliases": [ "CVE-2022-27776" ], "summary": "Auth/cookie leak on redirect", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-27776.json", "www": "https://curl.se/docs/CVE-2022-27776.html", "issue": "https://hackerone.com/reports/1547048", "CWE": { "id": "CWE-522", "desc": "Insufficiently Protected Credentials" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.82.0", "severity": "Low" }, "published": "2022-04-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "4.9"}, {"fixed": "7.83.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ae1912cb0d494b48d514d937826c9fe83ec96c4d"}, {"fixed": "6e659993952aa5f90f48864be84a1bbb047fc258"} ] } ], "versions": [ "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", "7.9.2", "7.9.1", "7.9", "7.8.1", "7.8", "7.7.3", "7.7.2", "7.7.1", "7.7", "7.6.1", "7.6", "7.5.2", "7.5.1", "7.5", "7.4.2", "7.4.1", "7.4", "7.3", "7.2.1", "7.2", "7.1.1", "7.1", "6.5.2", "6.5.1", "6.5", "6.4", "6.3.1", "6.3", "6.2", "6.1", "6.0", "5.11", "5.10", "5.9.1", "5.9", "5.8", "5.7.1", "5.7", "5.5.1", "5.5", "5.4", "5.3", "5.2.1", "5.2", "5.0", "4.10", "4.9" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl might leak authentication or cookie header data on HTTP redirects to the\nsame host but another port number.\n\nWhen asked to send custom headers or cookies in its HTTP requests, curl sends\nthat set of headers only to the host which name is used in the initial URL, so\nthat redirects to other hosts make curl send the data to those. However, due\nto a flawed check, curl wrongly also sends that same set of headers to the\nhosts that are identical to the first one but use a different port number or\nURL scheme. Contrary to expectation and intention.\n\nSending the same set of headers to a server on a different port number is a\nproblem for applications that pass on custom `Authorization:` or `Cookie:`\nheaders, as those headers often contain privacy sensitive information or data.\n\ncurl and libcurl have options that allow users to opt out from this check, but\nthat is not set by default." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-27775", "aliases": [ "CVE-2022-27775" ], "summary": "Bad local IPv6 connection reuse", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-27775.json", "www": "https://curl.se/docs/CVE-2022-27775.html", "issue": "https://hackerone.com/reports/1546268", "CWE": { "id": "CWE-200", "desc": "Exposure of Sensitive Information to an Unauthorized Actor" }, "award": { "amount": "480", "currency": "USD" }, "last_affected": "7.82.0", "severity": "Low" }, "published": "2022-04-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.65.0"}, {"fixed": "7.83.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "2d0e9b40d3237b1450cbbfbcb996da244d964898"}, {"fixed": "058f98dc3fe595f21dc26a5b9b1699e519ba5705"} ] } ], "versions": [ "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse, if one of them matches the setup.\n\nDue to errors in the logic, the config matching function did not take the IPv6\naddress zone id into account which could lead to libcurl reusing the wrong\nconnection when one transfer uses a zone id and a subsequent transfer uses\nanother (or no) zone id." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-27774", "aliases": [ "CVE-2022-27774" ], "summary": "Credential leak on redirect", "modified": "2023-05-06T00:27:48.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-27774.json", "www": "https://curl.se/docs/CVE-2022-27774.html", "issue": "https://hackerone.com/reports/1543773", "CWE": { "id": "CWE-522", "desc": "Insufficiently Protected Credentials" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.82.0", "severity": "Medium" }, "published": "2022-04-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "4.9"}, {"fixed": "7.83.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ae1912cb0d494b48d514d937826c9fe83ec96c4d"}, {"fixed": "139a54ed0a172adaaf1a78d6f4fff50b2c3f9e08"} ] } ], "versions": [ "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", "7.9.2", "7.9.1", "7.9", "7.8.1", "7.8", "7.7.3", "7.7.2", "7.7.1", "7.7", "7.6.1", "7.6", "7.5.2", "7.5.1", "7.5", "7.4.2", "7.4.1", "7.4", "7.3", "7.2.1", "7.2", "7.1.1", "7.1", "6.5.2", "6.5.1", "6.5", "6.4", "6.3.1", "6.3", "6.2", "6.1", "6.0", "5.11", "5.10", "5.9.1", "5.9", "5.8", "5.7.1", "5.7", "5.5.1", "5.5", "5.4", "5.3", "5.2.1", "5.2", "5.0", "4.10", "4.9" ] } ], "credits": [ { "name": "Harry Sintonen", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "curl follows HTTP(S) redirects when asked to. curl also supports\nauthentication. When a user and password are provided for a URL with a given\nhostname, curl makes an effort to not pass on those credentials to other hosts\nin redirects unless given permission with a special option.\n\nThis \"same host check\" has been flawed all since it was introduced. It does\nnot work on cross protocol redirects and it does not consider different port\nnumbers to be separate hosts. This leads to curl leaking credentials to other\nservers when it follows redirects from auth protected HTTP(S) URLs to other\nprotocols and port numbers. It could also leak the TLS SRP credentials this\nway.\n\nBy default, curl only allows redirects to HTTP(S) and FTP(S), but can be asked\nto allow redirects to all protocols curl supports." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2022-22576", "aliases": [ "CVE-2022-22576" ], "summary": "OAUTH2 bearer bypass in connection reuse", "modified": "2025-09-27T10:58:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2022-22576.json", "www": "https://curl.se/docs/CVE-2022-22576.html", "issue": "https://hackerone.com/reports/1526328", "CWE": { "id": "CWE-305", "desc": "Authentication Bypass by Primary Weakness" }, "award": { "amount": "2400", "currency": "USD" }, "last_affected": "7.82.0", "severity": "Medium" }, "published": "2022-04-27T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.33.0"}, {"fixed": "7.83.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "19a05c908f7d8be82de6f69f533317d8a0db49dd"}, {"fixed": "852aa5ad351ea53e5f01d2f44b5b4370c2bf5425"} ] } ], "versions": [ "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0" ] } ], "credits": [ { "name": "Patrick Monnerat", "type": "FINDER" }, { "name": "Patrick Monnerat", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl might reuse OAUTH2-authenticated connections without properly making\nsure that the connection was authenticated with the same credentials as set\nfor this transfer. This affects SASL-enabled protocols: SMTP(S), IMAP(S),\nPOP3(S) and LDAP(S) (OpenLDAP only).\n\nlibcurl maintains a pool of live connections after a transfer has completed\n(sometimes called the connection cache). This pool of connections is then gone\nthrough when a new transfer is requested and if there is a live connection\navailable that can be reused, it is preferred instead of creating a new one.\n\nDue to this security vulnerability, a connection that is successfully created\nand authenticated with a username + OAUTH2 bearer could subsequently be\nerroneously reused even for user + [other OAUTH2 bearer], even though that\nmight not even be a valid bearer. This could lead to an authentication bypass,\neither by mistake or by a malicious actor." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2021-22947", "aliases": [ "CVE-2021-22947" ], "summary": "STARTTLS protocol injection via MITM", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2021-22947.json", "www": "https://curl.se/docs/CVE-2021-22947.html", "issue": "https://hackerone.com/reports/1334763", "CWE": { "id": "CWE-349", "desc": "Acceptance of Extraneous Untrusted Data With Trusted Data" }, "award": { "amount": "1500", "currency": "USD" }, "last_affected": "7.78.0", "severity": "Medium" }, "published": "2021-09-15T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.20.0"}, {"fixed": "7.79.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ec3bb8f727405642a471b4b1b9eb0118fc003104"}, {"fixed": "8ef147c43646e91fdaad5d0e7b60351f842e5c68"} ] } ], "versions": [ "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0" ] } ], "credits": [ { "name": "Patrick Monnerat", "type": "FINDER" }, { "name": "Patrick Monnerat", "type": "REMEDIATION_DEVELOPER" } ], "details": "When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data\nsecurely using STARTTLS to upgrade the connection to TLS level, the server can\nstill respond and send back multiple responses before the TLS upgrade. Such\nmultiple *pipelined* responses are cached by curl. curl would then upgrade to\nTLS but not flush the in-queue of cached responses and instead use and trust\nthe responses it got *before* the TLS handshake as if they were authenticated.\n\nUsing this flaw, it allows a Man-In-The-Middle attacker to first inject the\nfake responses, then pass-through the TLS traffic from the legitimate server\nand trick curl into sending data back to the user thinking the attacker's\ninjected data comes from the TLS-protected server.\n\nOver POP3 and IMAP an attacker can inject fake response data." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2021-22946", "aliases": [ "CVE-2021-22946" ], "summary": "Protocol downgrade required TLS bypassed", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2021-22946.json", "www": "https://curl.se/docs/CVE-2021-22946.html", "issue": "https://hackerone.com/reports/1334111", "CWE": { "id": "CWE-325", "desc": "Missing Cryptographic Step" }, "award": { "amount": "1000", "currency": "USD" }, "last_affected": "7.78.0", "severity": "Medium" }, "published": "2021-09-15T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.20.0"}, {"fixed": "7.79.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ec3bb8f727405642a471b4b1b9eb0118fc003104"}, {"fixed": "364f174724ef115c63d5e5dc1d3342c8a43b1cca"} ] } ], "versions": [ "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0" ] } ], "credits": [ { "name": "Patrick Monnerat", "type": "FINDER" }, { "name": "Patrick Monnerat", "type": "REMEDIATION_DEVELOPER" } ], "details": "A user can tell curl to **require** a successful upgrade to TLS when speaking\nto an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or\n`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` with\nlibcurl). This requirement could be bypassed if the server would return a\nproperly crafted but perfectly legitimate response.\n\nThis flaw would then make curl silently continue its operations **without\nTLS** contrary to the instructions and expectations, exposing possibly\nsensitive data in clear text over the network." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2021-22945", "aliases": [ "CVE-2021-22945" ], "summary": "UAF and double free in MQTT sending", "modified": "2025-05-15T17:48:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2021-22945.json", "www": "https://curl.se/docs/CVE-2021-22945.html", "issue": "https://hackerone.com/reports/1269242", "CWE": { "id": "CWE-415", "desc": "Double Free" }, "award": { "amount": "1000", "currency": "USD" }, "last_affected": "7.78.0", "severity": "Medium" }, "published": "2021-09-15T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.73.0"}, {"fixed": "7.79.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "2522903b792ac5a802f780df60dc4647c58e2477"}, {"fixed": "43157490a5054bd24256fe12876931e8abc9df49"} ] } ], "versions": [ "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0" ] } ], "credits": [ { "name": "z2_", "type": "FINDER" }, { "name": "z2_", "type": "REMEDIATION_DEVELOPER" } ], "details": "When sending data to an MQTT server, libcurl could in some circumstances\nerroneously keep a pointer to an already freed memory area and both use that\nagain in a subsequent call to send data and also free it *again*." }]