Description
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.56.1-1 | — |
| Debian 13 | curl | 7.56.1-1 | — |
| Debian 12 | curl | 7.56.1-1 | — |
| Debian 9 | curl | 7.52.1-5+deb9u2 | DSA-4007-1 |
| Debian 8 | curl | 7.38.0-4+deb8u7 | DSA-4007-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | curl | 7.26.0-1+wheezy22 | DLA-1143-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | curl | 7.47.0-1ubuntu2.4 | USN-3457-1 |
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.12 | USN-3457-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | curl +2 | 7.29.0-42.el7_4.1 | RHSA-2017:3263 |
| RHEL 3 | httpd24-curl +2 | 7.61.1-1.el6 | RHSA-2018:3558 |
| RHEL 3 | httpd24-httpd +5 | 2.4.34-7.el6 | RHSA-2018:3558 |
| RHEL 3 | httpd24-mod_md | 2.4.34-7.el7 | RHSA-2018:3558 |
| RHEL 3 | httpd24-mod_ssl +1 | 1:2.4.34-7.el6 | RHSA-2018:3558 |
| RHEL 3 | httpd24-nghttp2 +2 | 1.7.1-7.el6 | RHSA-2018:3558 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | curl | 7.37.0-37.8.1 | SUSE-SU-2017:2831-1 |
| SLES 12 SP2 | curl | 7.37.0-37.8.1 | SUSE-SU-2017:2831-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | curl | 7.37.0-37.8.1 | SUSE-SU-2017:2831-1 |
| SLES for SAP 12 SP2 | curl | 7.37.0-37.8.1 | SUSE-SU-2017:2831-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.79.1-1.1 | openSUSE-SU-2024:10582-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 7.56.1-r0 | — |
| Alpine v3.23 | curl | 7.56.1-r0 | — |
| Alpine v3.22 | curl | 7.56.1-r0 | — |
| Alpine v3.21 | curl | 7.56.1-r0 | — |
| Alpine v3.20 | curl | 7.56.1-r0 | — |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 7.56.1-r0 | — |
| Alpine v3.18 | curl | 7.56.1-r0 | — |
| Alpine v3.17 | curl | 7.56.1-r0 | — |
| Alpine v3.16 | curl | 7.56.1-r0 | — |
| Alpine v3.15 | curl | 7.56.1-r0 | — |
| Alpine v3.14 | curl | 7.56.1-r0 | — |
| Alpine v3.13 | curl | 7.56.1-r0 | — |
| Alpine v3.12 | curl | 7.56.1-r0 | — |
| Alpine v3.11 | curl | 7.56.1-r0 | — |
| Alpine v3.10 | curl | 7.56.1-r0 | — |
| Alpine v3.9 | curl | 7.56.1-r0 | — |
| Alpine v3.8 | curl | 7.56.1-r0 | — |
| Alpine v3.7 | curl | 7.56.1-r0 | — |
| Alpine v3.6 | curl | 7.56.1-r0 | — |
| Alpine v3.5 | curl | 7.56.1-r0 | — |
| Alpine v3.4 | curl | 7.55.0-r2 | — |
| Alpine v3.3 | curl | 7.55.0-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | curl +2 | 7.61.1-9.amzn2.0.1 | ALAS2-2019-1162 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | curl +2 | 7.29.0-42.el7_4.1 | ELSA-2017-3263 |
Advisories 13
- RHSA-2018:3558 Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3263 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- USN-3457-1 curl vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4007-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1143-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10582-1 curl-7.79.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2831-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- VDE-2019-009 PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152 CERT@VDE · May 22, 2025
- WID-SEC-2023-1645 libcurl: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Jul 4, 2023
- ICSA-19-155-01 PHOENIX CONTACT PLCNext AXC F 2152 CISA ICS & IT advisories · Jun 4, 2019
- ALAS2-2019-1162 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 18, 2019
- ELSA-2017-3263 Moderate: curl security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 27, 2017
References
- https://curl.haxx.se/docs/adv_20171023.html
- RHSA-2017:3263 vendor-advisory
- GLSA-201712-04 vendor-advisory
- 1039644 vdb-entry
- RHSA-2018:3558 vendor-advisory
- 101519 vdb-entry
- DSA-4007 vendor-advisory
- RHSA-2018:2486 vendor-advisory