Skip to content
OpenAdvisories

Package · Alpine

curl

196 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Low 3.4
    CVE-2025-0167

    netrc and default credential leak

    When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` ent…

    curl curl curl curl Debian Ubuntu Alpine
  • Low 3.4
    CVE-2024-11053

    netrc and redirect credential leak

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that …

    curl curl curl curl Debian Ubuntu Alpine
  • Low 3.1
    CVE-2024-6874

    macidn punycode buffer overread

    libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to us…

    curl curl curl curl Debian Alpine
  • Low 3.5
    CVE-2024-2004

    Usage of disabled protocol

    When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se wi…

    curl curl curl curl Debian Ubuntu Alpine
  • Low 3.7
    CVE-2022-35252

    When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …

    curl curl curl Debian Ubuntu Alpine
  • Low 3.7
    CVE-2021-22924 Public exploit

    libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…

    curl curl curl Debian Ubuntu Alpine
  • Low 3.1
    CVE-2021-22898

    curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…

    curl curl curl Debian Ubuntu Alpine
  • Low 3.7
    CVE-2020-8284

    A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP ad…

    curl curl curl Debian Ubuntu Alpine
  • Low 3.7
    CVE-2016-8616

    A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons …

    The curl Project curl curl curl Debian Ubuntu Alpine
  • Low 3.3
    CVE-2016-8623

    A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-aft…

    The curl Project curl curl curl Debian Ubuntu Alpine
  • Low 3.3
    CVE-2016-8617

    The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if…

    The curl Project curl curl curl Debian Ubuntu Alpine
  • Low 3.7
    CVE-2016-8622

    The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if t…

    The curl Project curl curl curl Debian Ubuntu Alpine
  • Low 2.4
    CVE-2017-7407

    The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensiti…

    curl curl curl Debian Ubuntu Alpine