curl / Docs / Vulnerability table / 8.7.1 vulnerabilities

Vulnerabilities in curl 8.7.1

Related:
Audits
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

curl version 8.7.1 was released on March 27 2024

It has the following 17 published security problems.

Flaw	From version	To and including
wrong proxy connection reuse with credentials	7.7	8.18.0
token leak with redirect and netrc	7.33.0	8.18.0
bad reuse of HTTP Negotiate connection	7.10.6	8.18.0
libssh key passphrase bypass without agent set	7.58.0	8.17.0
libssh global known_hosts override	7.58.0	8.17.0
OpenSSL partial chain store policy bypass	7.87.0	8.17.0
bearer token leak on cross-protocol redirect	7.33.0	8.17.0
broken TLS options for threaded LDAPS	7.17.0	8.17.0
missing SFTP host verification with wolfSSH	7.69.0	8.16.0
No QUIC certificate pinning with wolfSSL	8.5.0	8.13.0
gzip integer overflow	7.10.5	8.11.1
netrc and default credential leak	7.76.0	8.11.1
netrc and redirect credential leak	7.76.0	8.11.0
HSTS subdomain overwrites parent cache entry	7.74.0	8.10.1
OCSP stapling bypass with GnuTLS	7.41.0	8.9.1
ASN.1 date parser overread	7.32.0	8.9.0
freeing stack buffer in utf8asn1str	8.6.0	8.8.0

Further details

CVE data for 8.7.1 provided as JSON.

Changelog for curl 8.7.1

See vulnerability summary for the previous release: 8.7.0 or the subsequent release: 8.8.0