Advisories · Technology
curl.
Every CVE that names curl among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
wrong proxy connection reuse with credentials
- curl
- CWE-305
- CVSS 5.3 Medium
token leak with redirect and netrc
- curl
- Hard-coded credentials
- CVSS 6.5 Medium
bad reuse of HTTP Negotiate connection
- curl
- CWE-305
- CVSS 4.6 Medium
wcurl path traversal with percent-encoded slashes
- curl
- CVSS 3.1 Low
libssh key passphrase bypass without agent set
- curl
- Authentication bypass
- CVSS 5.3 Medium
libssh global known_hosts override
- curl
- Weak cryptography or TLS
- CVSS 5.3 Medium
OpenSSL partial chain store policy bypass
- curl
- Weak cryptography or TLS
- CVSS 5.3 Medium
bearer token leak on cross-protocol redirect
- curl
- Hard-coded credentials
- CVSS 6.3 Medium
broken TLS options for threaded LDAPS
- curl
- CWE-567
- CVSS 5.9 Medium
No QUIC certificate pinning with GnuTLS
- curl
- Weak cryptography or TLS
- CVSS 4.3 Medium
missing SFTP host verification with wolfSSH
- curl
- CWE-322
- CVSS 5.3 Medium
predictable WebSocket mask
- curl
- CWE-340
- CVSS 7.5 High
Out of bounds read for cookie path
- curl
- Memory corruption
- CVSS 7.5 High
WebSocket endless loop
- curl
- CVSS 4.8 Medium
No QUIC certificate pinning with wolfSSL
- curl
- CVSS 6.5 Medium
QUIC certificate check skip with wolfSSL
- curl
- CVSS 7.3 High
gzip integer overflow
- curl
- CVSS 7.0 High
eventfd double close
- curl
- CVSS 3.4 Low
netrc and default credential leak
- curl
- CVSS 3.4 Low
netrc and redirect credential leak
- curl
- CVSS 5.9 Medium
HSTS subdomain overwrites parent cache entry
- curl
- CVSS 6.5 Medium
OCSP stapling bypass with GnuTLS
- curl
- Weak cryptography or TLS
- CVSS 6.3 Medium
ASN.1 date parser overread
- curl
- CVSS 3.1 Low
macidn punycode buffer overread
- curl
- CVSS 7.5 High
freeing stack buffer in utf8asn1str
- curl
- CVSS 6.5 Medium
TLS certificate check bypass with mbedTLS
- curl
- Weak cryptography or TLS
- CVSS 6.3 Medium
QUIC certificate check bypass with wolfSSL
- curl
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
HTTP/2 push headers memory-leak
- curl
- CVSS 3.5 Low
Usage of disabled protocol
- curl
- CWE-436
- CVSS 5.3 Medium
OCSP verification bypass with TLS session reuse
- curl
- CVSS 5.3 Medium
Missing encryption of sensitive data in curl
- curl
- Weak cryptography or TLS
- CVSS 6.5 Medium
curl: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then…
- curl
- CWE-178
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
Out-of-bounds write in curl
- curl
- Memory corruption
-
curl: This flaw allows an attacker to insert cookies at will into a running program using…
- curl
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Resource allocation without limits in curl
- curl
- Denial of service
-
curl: Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or…
- curl
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Heap-based buffer overflow in curl
- curl
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Double free in curl
- curl
- Memory corruption
-
Code injection in curl
- curl
- Code injection
- CVSS 7.8 HighCritical · CVSS 7+ and EPSS
Heap-based buffer overflow in curl
- curl
- Memory corruption
-
Incorrect buffer size calculation in curl
- curl
- Memory corruption
- CVSS 4.3 Medium
Out-of-bounds read in curl
- curl
- Memory corruption
- CVSS 7.1 HighCritical · CVSS 7+ and EPSS
Stack-based buffer overflow in curl
- curl
- Memory corruption
- CVSS 5.4 Medium
Out-of-bounds read in curl
- curl
- Memory corruption
- CVSS 4.3 Medium
Use after free in curl
- curl
- Memory corruption
- CVSS 5.3 Medium
Improper input validation in curl
- curl
- CWE-20
- CVSS 3.3 Low
Use after free in curl
- curl
- Memory corruption
- CVSS 6.5 Medium
Buffer overflow in curl
- curl
- Memory corruption
- CVSS 5.3 Medium
Use after free in curl
- curl
- Memory corruption
- CVSS 3.7 Low
curl: A flaw was found in curl before version 7.51.0 When re-using a connection…
- curl
- CWE-592
- CVSS 5.3 Medium
A flaw was found in curl before version 7.51.
- curl
- CWE-99
- CVSS 5.3 Medium
Out-of-bounds read in curl
- curl
- Memory corruption
- CVSS 3.3 Low
Out-of-bounds write in curl
- curl
- Memory corruption
- CVSS 5.3 Medium
Improper input validation in curl
- curl
- CWE-20
- CVSS 3.7 Low
Integer overflow in curl
- curl
- Memory corruption
- CVSS 5.3 Medium
Use after free in curl
- curl
- Memory corruption
- CVSS 4.3 Medium
Improper certificate validation in curl
- curl
- Weak cryptography or TLS
- CVSS 6.5 Medium
curl: curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal…
- curl
- CWE-665