| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations, curl fails to apply user-specified Secure Shell (SSH) host verification settings. A malicious server can exploit this flaw by redirecting requests to an untrusted server, causing the connection to proceed without validating the remote host's identity. This failure can enable an attacker to intercept communications, leading to sensitive information disclosure. |
| A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens. |
| A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface. |
| A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitive authentication tokens, such as Kerberos tickets, to the third party. This flaw can lead to unauthorized information disclosure of user credentials across domain boundaries. |
| A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data. |
| A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS). |
| A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system. |
| A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts, indefinitely blocking concurrent transfers and resulting in a Denial of Service (DoS). |
| A flaw was found in curl. A remote malicious server can trigger a denial of service (DoS) in cookie handling by providing an overly long cookie name and value that exceeds curl's line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort parsing upon encountering the oversized entry, causing all remaining valid cookies in the file to be ignored. |
| A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the certificate and authorizing an invalid key during the Transport Layer Security (TLS) handshake. |
| A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session. |
| A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests intended for one server to be transmitted over an established connection to another, potentially resulting in information disclosure. |
| A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol (FTP) transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security (TLS), curl fails to perform a new handshake or authentication. As a result, the subsequent transfer operates under the prior session's identity, allowing it to perform operations on the remote server with unintended authorization. |
| A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure. |
| A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS). |
| A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file (such as a .netrc file), requesting the effective URL metadata can cause the returned destination address to improperly include those secret credentials. A local user may exploit this issue to view sensitive authentication tokens if an application or script queries and logs or displays the resolved URL. |
| A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server. |
| A flaw was found in curl. When persistent HTTP Strict Transport Security (HSTS) caching is enabled, a remote HTTPS server can return an out-of-range expiration value that fails time serialization during cache saving. Because curl truncates the cache file prior to writing the update, this serialization failure causes the persistent HSTS cache to be deleted or emptied. As a result, stored security policies for known hosts are lost, potentially allowing future connections to fall back to insecure communication. |
| A flaw was found in curl. When importing HTTP Strict Transport Security (HSTS) cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade subsequent connections for the subdomain to HTTPS and transmits unencrypted requests, allowing a network attacker to intercept sensitive data. |
| A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security (TLS) backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different destination, causing curl to inappropriately reuse an already authenticated connection. This issue can result in information disclosure by exposing client certificates and credentials to unintended origins. |
