196 results · Feed
-
Low 3.1
macidn punycode buffer overread
libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to us…
-
High 7.5
freeing stack buffer in utf8asn1str
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementatio…
-
Medium 6.5
TLS certificate check bypass with mbedTLS
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore…
-
Medium 6.3
QUIC certificate check bypass with wolfSSL
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certifica…
-
High 8.6CVE-2024-2398 EPSS 36%
HTTP/2 push headers memory-leak
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the prev…
-
Low 3.5
Usage of disabled protocol
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se wi…
-
Medium 5.3
OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the ve…
-
Medium 5.3
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requ…
-
Medium 6.5
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …
-
High 8.8
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…
-
Unscored —
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of …
-
High 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…
-
Medium 5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for res…
-
Medium 5.3
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …
-
Medium 5.9
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard pat…
-
High 7.5
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's pub…
-
Critical 9.8
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an att…
-
Medium 5.9
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in …
-
High 7.7
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH c…
-
Medium 5.9
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously…
-
Unscored —
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing wa…
-
High 8.8
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly r…
-
Medium 6.5
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functiona…
-
Critical 9.1
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functiona…
-
Medium 6.5
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HT…
-
Medium 5.9
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it support…
-
High 7.5CVE-2022-43551 EPSS 17%
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS…
-
Unscored —
curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white s…
-
Critical 9.8
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data …
-
High 8.1
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it se…
-
High 7.5
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, cur…
-
Low 3.7
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …
-
Medium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…
-
Medium 4.3CVE-2022-32205 EPSS 31%
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 st…
-
Critical 9.8CVE-2022-32207 EPSS 12%
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…
-
Medium 6.5CVE-2022-32206 EPSS 36%
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …
-
Unscored —
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is use…
-
Medium 5.3
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, m…
-
High 7.5
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address th…
-
Unscored —
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header…