Browse CVEs

MEDIUM 6.5 CVE-2023-23916 An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, mea… Curl 7.88.0+ Fix from $1,6002023-02-23 MEDIUM 5.9 CVE-2022-43552 A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP … Curl 7.87.0 / 8.2.12+ Fix from $1,6002023-02-09 HIGH 7.5 CVE-2022-43551EPSS 17% A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instruct… Curl 7.87.0 / 8.2.12+ Fix from $1,9502022-12-23 CRITICAL 9.8 CVE-2022-32221 When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOP… Curl 7.86.0 / 12.6.3+ Fix from $2,3002022-12-05 MEDIUM 6.5 CVE-2022-35260 curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, c… Curl 7.86.0 / 8.2.12+ Fix from $1,6002022-12-05 HIGH 8.1 CVE-2022-42915 curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the re… Curl 7.86.0 / 12.6.3+ Fix from $1,9502022-10-29 HIGH 7.5 CVE-2022-42916 In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTT… Curl 7.86.0 / 8.2.12+ Fix from $1,9502022-10-29 CRITICAL 9.8 CVE-2022-32207EPSS 7% When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from … Curl 7.84.0+ Fix from $2,3002022-07-07 MEDIUM 6.5 CVE-2022-32206EPSS 32% curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with dif… Curl 7.84.0+ Fix from $1,6002022-07-07 MEDIUM 5.9 CVE-2022-32208EPSS 7% When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The… Curl 7.84.0+ Fix from $1,6002022-07-07 HIGH 7.5 CVE-2022-27780 The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usi… Curl 7.83.1+ Fix from $1,9502022-06-02 HIGH 7.5 CVE-2022-27781 libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an er… Curl 7.83.1+ Fix from $1,9502022-06-02 HIGH 7.5 CVE-2022-27782 libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl k… Curl 7.83.1 / 8.2.12+ Fix from $1,9502022-06-02 MEDIUM 5.3 CVE-2022-27779 libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and… Curl 7.83.1+ Fix from $1,6002022-06-02 HIGH 8.1 CVE-2022-27778 A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-e… Curl Patch available Fix from $1,9502022-06-02 HIGH 7.5 CVE-2022-27775 An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool … Curl after 7.82.0 Fix from $1,9502022-06-02 MEDIUM 6.5 CVE-2022-27776 A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the… Curl 7.83.0+ Fix from $1,6002022-06-02 MEDIUM 5.7 CVE-2022-27774 An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extr… Curl after 7.82.0 Fix from $1,6002022-06-02 HIGH 8.1 CVE-2022-22576 An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections witho… Curl 7.83.0+ Fix from $1,9502022-05-26 HIGH 7.5 CVE-2021-22946 A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the… Curl 7.79.0+ Fix from $1,9502021-09-29 MEDIUM 5.9 CVE-2021-22947 When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respo… Curl 7.79.0+ Fix from $1,6002021-09-29 HIGH 7.5 CVE-2021-22926EPSS 10% libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cer… Curl 7.78.0+ Fix from $1,9502021-08-05 MEDIUM 6.5 CVE-2021-22922 When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The … Curl 1.0.1.1 / 7.78.0+ Fix from $1,6002021-08-05 MEDIUM 5.3 CVE-2021-22923 When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those sam… Curl 1.0.1.1 / 7.78.0+ Fix from $1,6002021-08-05 MEDIUM 5.3 CVE-2021-22925 curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pair… Curl 7.78.0+ Fix from $1,6002021-08-05 HIGH 8.1 CVE-2021-22901EPSS 60% curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arr… Curl 11.1.2.4.047 / 21.3+ Fix from $1,9502021-06-11 MEDIUM 5.3 CVE-2021-22897 curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcu… Curl 11.1.2.4.047 / 21.3+ Fix from $1,6002021-06-11 HIGH 7.8 CVE-2020-8177 curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file wh… Curl after 7.70.0 Fix from $1,9502020-12-14 HIGH 7.5 CVE-2020-8169 curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network… Curl 1.0.1.1 / 2.2+ Fix from $1,9502020-12-14 CRITICAL 9.8 CVE-2016-4606 Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive inform… Curl 7.49.1+ Fix from $2,3002020-02-21