curl / Docs / Vulnerability table / 7.9.1 vulnerabilities

Vulnerabilities in curl 7.9.1

curl version 7.9.1 was released on November 4 2001

It has the following 35 published security problems.

S	Flaw	First	Last
L	CVE-2026-8932: incomplete mTLS config matching in conn reuse	7.7	8.20.0
L	CVE-2026-3784: wrong proxy connection reuse with credentials	7.7	8.18.0
L	CVE-2023-38546: cookie injection with none file	7.9.1	8.3.0
L	CVE-2023-28322: more POST-after-PUT confusion	7.7	8.0.1
L	CVE-2023-27533: TELNET option IAC injection	7.7	7.88.1
M	CVE-2022-32221: POST following PUT confusion	7.7	7.85.0
L	CVE-2022-35252: control code in cookie denial of service	4.9	7.84.0
L	CVE-2022-27776: Auth/cookie leak on redirect	4.9	7.82.0
M	CVE-2022-27774: Credential leak on redirect	4.9	7.82.0
M	CVE-2021-22925: TELNET stack contents disclosure again	7.7	7.77.0
M	CVE-2021-22898: TELNET stack contents disclosure	7.7	7.76.1
L	CVE-2021-22876: Automatic referer leaks credentials	7.1.1	7.75.0
L	CVE-2020-8284: trusting FTP PASV responses	4.0	7.73.0
L	CVE-2018-1000007: HTTP authentication leak in redirects	6.0	7.57.0
M	CVE-2017-1000254: FTP PWD response parser out of bounds read	7.7	7.55.1
M	CVE-2017-7407: --write-out out of buffer read	6.5	7.53.1
M	CVE-2016-9586: printf floating point buffer overflow	5.4	7.51.0
H	CVE-2016-8615: cookie injection for other servers	4.9	7.50.3
M	CVE-2016-8616: case insensitive password comparison	7.7	7.50.3
M	CVE-2016-8617: OOB write via unchecked multiplication	7.8.1	7.50.3
M	CVE-2016-8618: double free in curl_maprintf	5.4	7.50.3
H	CVE-2016-8619: double free in krb5 code	7.3	7.50.3
M	CVE-2016-8624: invalid URL parsing with '#'	6.0	7.50.3
H	CVE-2016-5419: TLS session resumption client cert bypass	5.0	7.50.0
M	CVE-2016-5420: Reusing connections with wrong client cert	7.7	7.50.0
H	CVE-2016-0754: remote filename path traversal in curl tool for Windows	4.0	7.46.0
H	CVE-2015-3153: sensitive HTTP server headers also sent to proxies	4.0	7.42.0
H	CVE-2014-8150: URL request injection	6.0	7.39.0
M	CVE-2014-3613: cookie leak with IP address as domain	4.0	7.37.1
H	CVE-2013-2174: URL decode buffer boundary flaw	7.7	7.30.0
H	CVE-2013-1944: cookie domain tailmatch	4.7	7.29.0
H	CVE-2009-2417: embedded zero in cert name	7.4	7.19.5
M	CVE-2009-0037: Arbitrary File Access	5.11	7.19.3
H	CVE-2005-0490: Authentication Buffer Overflows	7.3	7.13.0
H	CVE-2003-1605: Proxy Authentication Header Information Leakage	4.5	7.10.6

Further details

CVE data for 7.9.1 provided as JSON.

Changelog for curl 7.9.1

See vulnerability summary for the previous release: 7.9 or the subsequent release: 7.9.2