Skip to content
OpenAdvisories

Package · Wolfi

curl

29 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.9
    CVE-2024-9681

    HSTS subdomain overwrites parent cache entry

    When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2024-8096

    OCSP stapling bypass with GnuTLS

    When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the ret…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.3
    CVE-2024-7264 EPSS 20%

    ASN.1 date parser overread

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting per…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2024-2466

    TLS certificate check bypass with mbedTLS

    libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore…

    curl curl curl curl Debian Azure Linux Alpine Wolfi
  • Medium 6.3
    CVE-2024-2379

    QUIC certificate check bypass with wolfSSL

    libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certifica…

    curl curl curl curl Debian Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2024-0853

    OCSP verification bypass with TLS session reuse

    curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the ve…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-46219

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requ…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2023-46218

    This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2022-43552

    A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it support…

    mysql curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi