Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / Vulnerability table / 8.5.0 vulnerabilities

Vulnerabilities in curl 8.5.0

Related:
Audits
Bug Bounty
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

curl version 8.5.0 was released on December 6 2023

It has the following 7 published security problems.

FlawFrom versionTo and including
HSTS subdomain overwrites parent cache entry7.74.08.10.1
OCSP stapling bypass with GnuTLS7.41.08.9.1
ASN.1 date parser overread7.32.08.9.0
TLS certificate check bypass with mbedTLS8.5.08.6.0
HTTP/2 push headers memory-leak7.44.08.6.0
Usage of disabled protocol7.85.08.6.0
OCSP verification bypass with TLS session reuse8.5.08.5.0

Futher details

CVE data for 8.5.0 provided as JSON.

Changelog for curl 8.5.0

See vulnerability summary for the previous release: 8.4.0 or the subsequent release: 8.6.0