# https\://github.com/curl/curl.

Every CVE that names https://github.com/curl/curl among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-28322.md)
  `CVE-2023-28322` · CVE record: https\://github.com/curl/curl · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2023 · Tags: Information disclosure
- [Improper certificate validation in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-28321.md)
  `CVE-2023-28321` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2023 · Tags: Weak cryptography or TLS
- [Uncontrolled resource consumption in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-28320.md)
  `CVE-2023-28320` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2023 · Tags: Denial of service
- [Use after free in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-28319.md)
  `CVE-2023-28319` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Not analysed yet · Published 26 May 2023 · Tags: Memory corruption
- [An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have pr…](https://agentprime.io/advisories/CVE-2023-27538.md)
  `CVE-2023-27538` · CVE record: https\://github.com/curl/curl · CVSS 7.7 High · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-305
- [Double free in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-27537.md)
  `CVE-2023-27537` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 30 Mar 2023 · Tags: Memory corruption
- [An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to che…](https://agentprime.io/advisories/CVE-2023-27536.md)
  `CVE-2023-27536` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-305
- [An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers.](https://agentprime.io/advisories/CVE-2023-27535.md)
  `CVE-2023-27535` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-305
- [Path traversal in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-27534.md)
  `CVE-2023-27534` · CVE record: https\://github.com/curl/curl · CVSS 8.8 High · Not analysed yet · Published 30 Mar 2023 · Tags: Path traversal
- [A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during serve…](https://agentprime.io/advisories/CVE-2023-27533.md)
  `CVE-2023-27533` · CVE record: https\://github.com/curl/curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-75
- [Resource allocation without limits in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-23916.md)
  `CVE-2023-23916` · CVE record: https\://github.com/curl/curl · CVSS 6.5 Medium · Not analysed yet · Published 23 Feb 2023 · Tags: Denial of service
- [Cleartext transmission of sensitive information in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-23915.md)
  `CVE-2023-23915` · CVE record: https\://github.com/curl/curl · CVSS 6.5 Medium · Not analysed yet · Published 23 Feb 2023 · Tags: Weak cryptography or TLS
- [Cleartext transmission of sensitive information in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2023-23914.md)
  `CVE-2023-23914` · CVE record: https\://github.com/curl/curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Feb 2023 · Tags: Weak cryptography or TLS
- [Use after free in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-43552.md)
  `CVE-2022-43552` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 9 Feb 2023 · Tags: Memory corruption
- [Cleartext transmission of sensitive information in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-43551.md)
  `CVE-2022-43551` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 23 Dec 2022 · Tags: Weak cryptography or TLS
- [Out-of-bounds read in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-35260.md)
  `CVE-2022-35260` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 5 Dec 2022 · Tags: Memory corruption
- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-32221.md)
  `CVE-2022-32221` · CVE record: https\://github.com/curl/curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2022 · Tags: Information disclosure
- [Improper input validation in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-35252.md)
  `CVE-2022-35252` · CVE record: https\://github.com/curl/curl · CVSS 3.7 Low · Not analysed yet · Published 23 Sept 2022 · Tags: CWE-20
- [When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.](https://agentprime.io/advisories/CVE-2022-32208.md)
  `CVE-2022-32208` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2022 · Tags: CWE-840
- [When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In…](https://agentprime.io/advisories/CVE-2022-32207.md)
  `CVE-2022-32207` · CVE record: https\://github.com/curl/curl · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 7 Jul 2022 · Tags: CWE-840
- [Resource allocation without limits in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-32206.md)
  `CVE-2022-32206` · CVE record: https\://github.com/curl/curl · CVSS 6.5 Medium · EPSS 0.36 · Not analysed yet · Published 7 Jul 2022 · Tags: Denial of service
- [Resource allocation without limits in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-32205.md)
  `CVE-2022-32205` · CVE record: https\://github.com/curl/curl · CVSS 4.3 Medium · EPSS 0.31 · Not analysed yet · Published 7 Jul 2022 · Tags: Denial of service
- [A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when \`--no-clobber\` is used together with \`--remove-on-error\`.](https://agentprime.io/advisories/CVE-2022-27778.md)
  `CVE-2022-27778` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 1 Jun 2022 · Tags: CWE-706
- [Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL.](https://agentprime.io/advisories/CVE-2022-30115.md)
  `CVE-2022-30115` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 1 Jun 2022 · Tags: CWE-325
- [libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection p…](https://agentprime.io/advisories/CVE-2022-27782.md)
  `CVE-2022-27782` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2022 · Tags: CWE-840
- [Uncontrolled resource consumption in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-27781.md)
  `CVE-2022-27781` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2022 · Tags: Denial of service
- [The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a \*different\* URL usingthe wrong host name when it is later retrieved.F…](https://agentprime.io/advisories/CVE-2022-27780.md)
  `CVE-2022-27780` · CVE record: https\://github.com/curl/curl · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2022 · Tags: CWE-177
- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-27779.md)
  `CVE-2022-27779` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 1 Jun 2022 · Tags: Information disclosure
- [Insufficiently protected credentials in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-27776.md)
  `CVE-2022-27776` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 1 Jun 2022 · Tags: Hard-coded credentials
- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-27775.md)
  `CVE-2022-27775` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2022 · Tags: Information disclosure
- [Insufficiently protected credentials in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-27774.md)
  `CVE-2022-27774` · CVE record: https\://github.com/curl/curl · CVSS 5.7 Medium · Not analysed yet · Published 1 Jun 2022 · Tags: Hard-coded credentials
- [Improper authentication in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2022-22576.md)
  `CVE-2022-22576` · CVE record: https\://github.com/curl/curl · CVSS 8.1 High · Not analysed yet · Published 26 May 2022 · Tags: Authentication bypass
- [When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that c…](https://agentprime.io/advisories/CVE-2021-22947.md)
  `CVE-2021-22947` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2021 · Tags: CWE-310
- [Cleartext transmission of sensitive information in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22946.md)
  `CVE-2021-22946` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2021 · Tags: Weak cryptography or TLS, CWE-325
- [Double free in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22945.md)
  `CVE-2021-22945` · CVE record: https\://github.com/curl/curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2021 · Tags: Memory corruption
- [Improper input validation in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22924.md)
  `CVE-2021-22924` · CVE record: https\://github.com/curl/curl · CVSS 3.7 Low · Not analysed yet · Published 5 Aug 2021 · Tags: CWE-20
- [libcurl-using applications can ask for a specific client certificate to be used in a transfer.](https://agentprime.io/advisories/CVE-2021-22926.md)
  `CVE-2021-22926` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 5 Aug 2021 · Tags: CWE-840
- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22925.md)
  `CVE-2021-22925` · CVE record: https\://github.com/curl/curl · CVSS 5.3 Medium · Not analysed yet · Published 5 Aug 2021 · Tags: Information disclosure
- [Cleartext transmission of sensitive information in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22923.md)
  `CVE-2021-22923` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 5 Aug 2021 · Tags: Weak cryptography or TLS
- [When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to…](https://agentprime.io/advisories/CVE-2021-22922.md)
  `CVE-2021-22922` · CVE record: https\://github.com/curl/curl · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2021 · Tags: CWE-840
- [Use after free in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22901.md)
  `CVE-2021-22901` · CVE record: https\://github.com/curl/curl · No CVSS score · EPSS 0.64 · Not analysed yet · Published 11 Jun 2021 · Tags: Memory corruption
- [curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library.](https://agentprime.io/advisories/CVE-2021-22897.md)
  `CVE-2021-22897` · CVE record: https\://github.com/curl/curl · CVSS 5.3 Medium · Not analysed yet · Published 11 Jun 2021 · Tags: CWE-840
- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22898.md)
  `CVE-2021-22898` · CVE record: https\://github.com/curl/curl · CVSS 3.1 Low · Not analysed yet · Published 11 Jun 2021 · Tags: Information disclosure
- [curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets.](https://agentprime.io/advisories/CVE-2021-22890.md)
  `CVE-2021-22890` · CVE record: https\://github.com/curl/curl · CVSS 4.3 Medium · Not analysed yet · Published 1 Apr 2021 · Tags: CWE-300
- [Exposure of personal information in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2021-22876.md)
  `CVE-2021-22876` · CVE record: https\://github.com/curl/curl · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2021 · Tags: Information disclosure
- [curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.](https://agentprime.io/advisories/CVE-2020-8177.md)
  `CVE-2020-8177` · CVE record: https\://github.com/curl/curl · CVSS 7.8 High · Not analysed yet · Published 14 Dec 2020 · Tags: CWE-99
- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2020-8169.md)
  `CVE-2020-8169` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 14 Dec 2020 · Tags: Information disclosure
- [Improper certificate validation in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2020-8286.md)
  `CVE-2020-8286` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 14 Dec 2020 · Tags: Weak cryptography or TLS
- [Use after free in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2020-8231.md)
  `CVE-2020-8231` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 14 Dec 2020 · Tags: Memory corruption
- [Uncontrolled recursion in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2020-8285.md)
  `CVE-2020-8285` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Not analysed yet · Published 14 Dec 2020 · Tags: Denial of service
- [Information disclosure in https\://github.com/curl/curl](https://agentprime.io/advisories/CVE-2020-8284.md)
  `CVE-2020-8284` · CVE record: https\://github.com/curl/curl · CVSS 3.7 Low · Not analysed yet · Published 14 Dec 2020 · Tags: Information disclosure

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=https-github-com-curl-curl>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/https-github-com-curl-curl/>. Everything for agents: <https://agentprime.io/llms.txt>.