Curl vulnerabilities
98 CVEs and advisories name Curl as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-46219When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file
- CVE-2023-46218This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise all
- CVE-2023-38545This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
- CVE-2023-38546This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.
- CVE-2023-38039When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.
- CVE-2019-5436A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
- CVE-2019-5435An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
- CVE-2017-2629curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate