Description
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.13.0-2 | — |
| Debian 13 | curl | 7.13.0-2 | — |
| Debian 12 | curl | 7.13.0-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | curl +1 | 7.12.1-5.rhel4 | RHSA-2005:340 |
| RHEL 3 | curl +1 | 7.10.6-6.rhel3 | RHSA-2005:340 |
Advisories 1
- RHSA-2005:340 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 20050228 [USN-86-1] cURL vulnerability mailing-list
- CLA-2005:940 vendor-advisory
- 20050221 Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnerability third-party-advisory
- oval:org.mitre.oval:def:10273 vdb-entry signature
- 12616 vdb-entry
- 12615 vdb-entry
- curl-kerberos-bo(19423) vdb-entry
- 20050221 Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vulnerability third-party-advisory
- MDKSA-2005:048 vendor-advisory
- GLSA-200503-20 vendor-advisory
- RHSA-2005:340 vendor-advisory
- SUSE-SA:2005:011 vendor-advisory