CVE-2018-16839

curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVSS 3.0 · 4.3 Medium EPSS 5.8% KEV · Not listed

Vendors

Canonical Debian Haxx and 1 more

Products

Ubuntu Linux Debian Linux Curl and 1 more

CVE-2018-16842

curl: Heap-based buffer over-read in the curl tool warning formatting

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVSS 3.0 · 4.4 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Haxx and 1 more

Products

Ubuntu Linux Debian Linux Curl and 3 more

CVE-2016-8622

curl: URL unescape heap overflow via integer truncation

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

CVSS 3.0 · 3.7 Low EPSS 4.7% KEV · Not listed

Vendors

Haxx Redhat

Products

Libcurl Jboss Core Services Rhel Software Collections

CVE-2018-16890

curl: NTLM type-2 heap out-of-bounds buffer read

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

CVSS 3.1 · 7.5 High EPSS 5.4% KEV · Not listed

Vendors

Canonical Debian F5 and 5 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 8 more

CVE-2019-3822

curl: NTLMv2 type-3 header stack buffer overflow

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVSS 3.1 · 9.8 Critical EPSS 12.9% KEV · Not listed

Vendors

Canonical Debian Haxx and 4 more

Products

Ubuntu Linux Debian Linux Libcurl and 14 more

CVE-2019-3823

curl: SMTP end-of-response out-of-bounds read

libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.

CVSS 3.0 · 4.3 Medium EPSS 4.1% KEV · Not listed

Vendors

Canonical Debian Haxx and 3 more

Products

Ubuntu Linux Debian Linux Libcurl and 6 more

CVE-2025-24928

libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Netapp Redhat Xmlsoft

Products

Active Iq Unified Manager H300s H300s Firmware and 25 more

CVE-2023-28322

curl: more POST-after-PUT confusion

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Apple Fedoraproject Haxx and 2 more

Products

Macos Fedora Curl and 14 more

CVE-2023-25690

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.

CVSS 3.1 · 9.8 Critical EPSS 84.0% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Jboss Core Services and 5 more

CVE-2022-28615

Read beyond bounds in ap_strcmp_match()

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.

CVSS 3.1 · 9.1 Critical EPSS 6.5% KEV · Not listed

Vendors

Apache Fedoraproject Netapp and 1 more

Products

Http Server Fedora Clustered Data Ontap and 3 more

CVE-2016-1762

libxml2: Heap-based buffer-overread in xmlNextChar

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.1 · 8.1 High EPSS 6.1% KEV · Not listed

Vendors

Apple Canonical Debian and 3 more

Products

Iphone Os Mac Os X Safari and 14 more

CVE-2016-1834

libxml2: Heap-buffer-overflow in xmlStrncat

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

CVSS 3.1 · 7.8 High EPSS 4.6% KEV · Not listed

Vendors

Apple Canonical Debian and 3 more

Products

Iphone Os Mac Os X Tvos and 13 more

CVE-2016-3627

libxml2: stack exhaustion while parsing xml files in recovery mode

The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed

Vendors

Canonical Debian Hp and 4 more

Products

Ubuntu Linux Debian Linux Icewall Federation Agent and 12 more

CVE-2023-38039

curl: out of heap memory issue due to missing limit on header quantity

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

CVSS 3.1 · 7.5 High EPSS 56.2% KEV · Not listed

Vendors

Fedoraproject Haxx Microsoft and 1 more

Products

Fedora Curl Windows 10 1809 and 8 more

CVE-2024-38475

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

CVSS 3.1 · 9.1 Critical EPSS 100.0% KEV · Listed

Vendors

Apache Netapp Redhat and 1 more

Products

Http Server Ontap 9 Enterprise Linux and 16 more

CVE-2024-36387

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

CVSS 3.1 · 5.4 Medium EPSS 1.7% KEV · Not listed

Vendors

Apache Netapp Redhat

Products

Http Server Ontap Enterprise Linux and 1 more

CVE-2024-27316

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

CVSS 3.1 · 7.5 High EPSS 88.8% KEV · Not listed

Vendors

Apache Fedoraproject Netapp and 1 more

Products

Http Server Fedora Ontap and 4 more

CVE-2023-38709

Apache HTTP Server: HTTP response splitting

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

CVSS 3.1 · 7.3 High EPSS 3.9% KEV · Not listed

Vendors

Apache Apple Broadcom and 4 more

Products

Http Server Macos Fabric Operating System and 6 more

CVE-2017-9798

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

CVSS 3.1 · 7.5 High EPSS 94.7% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Http Server Debian Linux Enterprise Linux and 5 more

CVE-2017-3167

httpd: ap_get_basic_auth_pw() authentication bypass

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

CVSS 3.1 · 9.8 Critical EPSS 20.2% KEV · Not listed

Vendors

Apache Apple Debian and 3 more

Products

Http Server Mac Os X Debian Linux and 14 more