Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 209

Export CSV
CVE-2016-8615

curl: Cookie injection for other servers

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

CVSS 3.0 · 5.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8617

curl: Out-of-bounds write via unchecked multiplication

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2005-0490

security flaw

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

CVSS 3.1 · 8.8 High EPSS 5.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Libcurl Enterprise Linux
CVE-2018-1000301

curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

CVSS 3.1 · 9.1 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Debian Haxx and 2 more
Products
Ubuntu Linux Debian Linux Curl and 12 more
CVE-2017-8817

curl: FTP wildcard out of bounds read

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

CVSS 3.1 · 9.8 Critical EPSS 11.2% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Curl Libcurl and 1 more
CVE-2017-8816

curl: NTLM buffer overflow via integer overflow

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

CVSS 3.1 · 9.8 Critical EPSS 8.5% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Curl Libcurl and 1 more
CVE-2017-1000257

curl: IMAP FETCH response out of bounds read

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

CVSS 3.1 · 9.1 Critical EPSS 6.2% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Libcurl Enterprise Linux and 2 more
CVE-2016-8620

curl: Glob parser write/read out of bounds

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.

CVSS 3.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2016-9586

curl: printf floating point buffer overflow

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

CVSS 3.0 · 5.9 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2016-9594

curl: Unitialized random

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Haxx
Products
Curl
CVE-2018-16839

curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVSS 3.0 · 4.3 Medium EPSS 5.8% KEV · Not listed
Vendors
Canonical Debian Haxx and 1 more
Products
Ubuntu Linux Debian Linux Curl and 1 more
CVE-2018-16842

curl: Heap-based buffer over-read in the curl tool warning formatting

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVSS 3.0 · 4.4 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Haxx and 1 more
Products
Ubuntu Linux Debian Linux Curl and 3 more
CVE-2016-8622

curl: URL unescape heap overflow via integer truncation

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

CVSS 3.0 · 3.7 Low EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Libcurl Jboss Core Services Rhel Software Collections
CVE-2018-14618

curl: NTLM password overflow via integer overflow

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

CVSS 3.0 · 7.5 High EPSS 10.7% KEV · Not listed
Vendors
Canonical Debian Haxx and 1 more
Products
Ubuntu Linux Debian Linux Libcurl and 3 more
CVE-2018-16890

curl: NTLM type-2 heap out-of-bounds buffer read

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

CVSS 3.1 · 7.5 High EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian F5 and 5 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 8 more
CVE-2019-3822

curl: NTLMv2 type-3 header stack buffer overflow

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVSS 3.1 · 9.8 Critical EPSS 12.9% KEV · Not listed
Vendors
Canonical Debian Haxx and 4 more
Products
Ubuntu Linux Debian Linux Libcurl and 14 more
CVE-2019-3823

curl: SMTP end-of-response out-of-bounds read

libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.

CVSS 3.0 · 4.3 Medium EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Haxx and 3 more
Products
Ubuntu Linux Debian Linux Libcurl and 6 more
CVE-2026-3783

token leak with redirect and netrc

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-3805

use after free in SMB connection reuse

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl