Description
content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.20.0-1 | — |
| Debian 13 | curl | 7.20.0-1 | — |
| Debian 12 | curl | 7.20.0-1 | — |
| Debian 5.0 | curl | 7.18.2-8lenny4 | DSA-2023-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | curl +1 | 7.15.5-9.el5 | RHSA-2010:0273 |
| RHEL 4 | curl +1 | 7.12.1-11.1.el4_8.3 | RHSA-2010:0329 |
| RHEL 3 | curl +1 | 7.10.6-11.rhel3 | RHSA-2010:0329 |
Advisories 3
- RHSA-2010:0273 Red Hat Security Advisory: curl security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0329 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2023-1 curl - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- APPLE-SA-2010-06-15-1 vendor-advisory
- ADV-2010-0571 vdb-entry
- ADV-2010-0602 vdb-entry
- 20101027 rPSA-2010-0072-1 curl mailing-list
- 38843 third-party-advisory
- [oss-security] 20100309 Re: CVE Request -- cURL/libCURL 7.20.0 mailing-list
- 38981 third-party-advisory
- ADV-2010-1481 vdb-entry
- USN-1158-1 vendor-advisory
- http://curl.haxx.se/docs/adv_20100209.html
- ADV-2010-0725 vdb-entry
- DSA-2023 vendor-advisory
- RHSA-2010:0329 vendor-advisory
- oval:org.mitre.oval:def:10760 vdb-entry signature
- http://support.apple.com/kb/HT4188
- https://bugzilla.redhat.com/show_bug.cgi?id=563220
- MDVSA-2010:062 vendor-advisory
- 40220 third-party-advisory
- GLSA-201203-02 vendor-advisory
- FEDORA-2010-2720 vendor-advisory
- FEDORA-2010-2762 vendor-advisory
- 48256 third-party-advisory
- http://support.avaya.com/css/P8/documents/100081819
- [oss-security] 20100316 Re: CVE Request -- cURL/libCURL 7.20.0 mailing-list
- 39087 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- 45047 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2010-0072
- http://curl.haxx.se/libcurl-contentencoding.patch
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- oval:org.mitre.oval:def:6756 vdb-entry signature
- 39734 third-party-advisory
- http://curl.haxx.se/docs/security.html#20100209
- ADV-2010-0660 vdb-entry
- [oss-security] 20100209 CVE Request -- cURL/libCURL 7.20.0 mailing-list