Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 171

Export CSV
CVE-2017-1000101

curl: URL globbing out of bounds read

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2018-16840

curl: Use-after-free when closing "easy" handle in Curl_close()

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

CVSS 3.1 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Canonical Haxx Redhat
Products
Ubuntu Linux Curl Jboss Core Services
CVE-2016-8624

curl: Invalid URL parsing with '#'

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

CVSS 3.0 · 5.3 Medium EPSS 6.3% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8615

curl: Cookie injection for other servers

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

CVSS 3.0 · 5.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8617

curl: Out-of-bounds write via unchecked multiplication

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2005-0490

security flaw

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

CVSS 3.1 · 8.8 High EPSS 5.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Libcurl Enterprise Linux
CVE-2018-1000301

curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

CVSS 3.1 · 9.1 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Debian Haxx and 2 more
Products
Ubuntu Linux Debian Linux Curl and 12 more
CVE-2017-8817

curl: FTP wildcard out of bounds read

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

CVSS 3.1 · 9.8 Critical EPSS 11.2% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Curl Libcurl and 1 more
CVE-2017-8816

curl: NTLM buffer overflow via integer overflow

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

CVSS 3.1 · 9.8 Critical EPSS 8.5% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Curl Libcurl and 1 more
CVE-2016-8620

curl: Glob parser write/read out of bounds

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.

CVSS 3.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2016-9586

curl: printf floating point buffer overflow

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

CVSS 3.0 · 5.9 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2016-9594

curl: Unitialized random

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Haxx
Products
Curl
CVE-2018-16839

curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVSS 3.0 · 4.3 Medium EPSS 5.8% KEV · Not listed
Vendors
Canonical Debian Haxx and 1 more
Products
Ubuntu Linux Debian Linux Curl and 1 more
CVE-2018-16842

curl: Heap-based buffer over-read in the curl tool warning formatting

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVSS 3.0 · 4.4 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Haxx and 1 more
Products
Ubuntu Linux Debian Linux Curl and 3 more
CVE-2026-3783

token leak with redirect and netrc

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-3805

use after free in SMB connection reuse

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2025-11563

wcurl path traversal with percent-encoded slashes

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Wcurl Curl
CVE-2023-28322

curl: more POST-after-PUT confusion

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 2 more
Products
Macos Fedora Curl and 14 more