Description
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | curl | 7.61.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.62.0-1 | — |
| Debian 13 | curl | 7.62.0-1 | — |
| Debian 12 | curl | 7.62.0-1 | — |
| Debian 9 | curl | 7.52.1-5+deb9u7 | DSA-4286-1 |
| Debian 8 | curl | 7.38.0-4+deb8u12 | DLA-1498-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | curl | 7.58.0-2ubuntu3.3 | USN-3765-1 |
| Ubuntu 16.04 LTS | curl | 7.47.0-1ubuntu2.9 | USN-3765-1 |
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.17 | USN-3765-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | curl +2 | 7.29.0-51.el7_6.3 | RHSA-2019:1880 |
| RHEL 3 | httpd24-curl +2 | 7.61.1-1.el6 | RHSA-2018:3558 |
| RHEL 3 | httpd24-httpd +5 | 2.4.34-7.el6 | RHSA-2018:3558 |
| RHEL 3 | httpd24-mod_md | 2.4.34-7.el7 | RHSA-2018:3558 |
| RHEL 3 | httpd24-mod_ssl +1 | 1:2.4.34-7.el6 | RHSA-2018:3558 |
| RHEL 3 | httpd24-nghttp2 +2 | 1.7.1-7.el6 | RHSA-2018:3558 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | curl | 7.60.0-3.9.1 | SUSE-SU-2018:2714-1 |
| SLES 12 SP3 | curl | 7.37.0-37.26.1 | SUSE-SU-2018:2715-1 |
| SLES 11 SP4 | curl | 7.37.0-70.33.1 | SUSE-SU-2018:2717-1 |
| SLES 11 | curl-openssl1 | 7.37.0-70.33.1 | SUSE-SU-2018:2717-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Studio Onsite 1.3 | curl | 7.19.7-1.20.53.16.1 | SUSE-SU-2018:2629-1 |
| SLES for SAP 12 SP3 | curl | 7.37.0-37.26.1 | SUSE-SU-2018:2715-1 |
| SLES for SAP 11 SP4 | curl | 7.37.0-70.33.1 | SUSE-SU-2018:2717-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.79.1-1.1 | openSUSE-SU-2024:10582-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 7.61.1-r0 | — |
| Alpine v3.23 | curl | 7.61.1-r0 | — |
| Alpine v3.22 | curl | 7.61.1-r0 | — |
| Alpine v3.21 | curl | 7.61.1-r0 | — |
| Alpine v3.20 | curl | 7.61.1-r0 | — |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 7.61.1-r0 | — |
| Alpine v3.18 | curl | 7.61.1-r0 | — |
| Alpine v3.17 | curl | 7.61.1-r0 | — |
| Alpine v3.16 | curl | 7.61.1-r0 | — |
| Alpine v3.15 | curl | 7.61.1-r0 | — |
| Alpine v3.14 | curl | 7.61.1-r0 | — |
| Alpine v3.13 | curl | 7.61.1-r0 | — |
| Alpine v3.12 | curl | 7.61.1-r0 | — |
| Alpine v3.11 | curl | 7.61.1-r0 | — |
| Alpine v3.10 | curl | 7.61.1-r0 | — |
| Alpine v3.9 | curl | 7.61.1-r0 | — |
| Alpine v3.8 | curl | 7.61.1-r0 | — |
| Alpine v3.7 | curl | 7.61.1-r0 | — |
| Alpine v3.6 | curl | 7.61.1-r0 | — |
| Alpine v3.5 | curl | 7.61.1-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | curl +2 | 7.55.1-12.amzn2.0.7 | ALAS2-2018-1135 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | curl +2 | 7.29.0-51.0.1.el7_6.3 | ELSA-2019-1880 |
Advisories 16
- RHSA-2018:3558 Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2019:1880 Red Hat Security Advisory: curl security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-3765-1 curl vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4286-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1498-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10582-1 curl-7.79.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2629-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2715-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2714-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- SUSE-SU-2018:2717-1 Security update for curl SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-1642 cURL: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Benutzerrechten BSI CERT-Bund (WID) · Feb 4, 2025
- ICSA-21-068-10 Siemens SCALANCE and SIMATIC libcurl (Update B) CISA ICS & IT advisories · Mar 9, 2021
- ICSA-19-099-04 Siemens SINEMA Remote Connect (Update A) CISA ICS & IT advisories · Mar 9, 2021
- ELSA-2019-1880 Low: curl security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 30, 2019
- ALAS2-2018-1135 Low: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 19, 2018
References
- https://curl.haxx.se/docs/CVE-2018-14618.html
- GLSA-201903-03 vendor-advisory
- USN-3765-1 vendor-advisory
- RHSA-2018:3558 vendor-advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014
- DSA-4286 vendor-advisory
- 1041605 vdb-entry
- USN-3765-2 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618
- https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf
- RHSA-2019:1880 vendor-advisory