Product:

Curl

(Haxx)
Repositories • https://github.com/curl/curl
• https://github.com/bagder/curl
#Vulnerabilities 122
Date Id Summary Products Score Patch Annotated
2024-03-27 CVE-2024-2004 When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with... Macos, Fedora, Curl, Bootstrap_os, H300s_firmware, H410s_firmware, H500s_firmware, H700s_firmware, Ontap, Ontap_select_deploy_administration_utility N/A
2024-03-27 CVE-2024-2379 libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems. Macos, Curl, Active_iq_unified_manager, Bootstrap_os, H300s_firmware, H410s_firmware, H500s_firmware, H610c_firmware, H610s_firmware, H615c_firmware, H700s_firmware, Ontap_select_deploy_administration_utility N/A
2024-03-27 CVE-2024-2398 When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application. Macos, Fedora, Curl, Active_iq_unified_manager, Bootstrap_os, Brocade_fabric_operating_system, H300s_firmware, H410s_firmware, H500s_firmware, H610c_firmware, H610s_firmware, H615c_firmware, H700s_firmware, Ontap_select_deploy_administration_utility N/A
2024-03-27 CVE-2024-2466 libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). Macos, Curl, Bootstrap_os, H300s_firmware, H410s_firmware, H500s_firmware, H700s_firmware N/A
2024-09-11 CVE-2024-8096 When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. Debian_linux, Curl, Active_iq_unified_manager, Bootstrap_os, H300s_firmware, H410s_firmware, H500s_firmware, H700s_firmware, Ontap_select_deploy_administration_utility, Ontap_tools N/A
2024-12-11 CVE-2024-11053 When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Curl, Bootstrap_os, H300s_firmware, H410s_firmware, H500s_firmware, H610c_firmware, H610s_firmware, H615c_firmware, H700s_firmware, Ontap, Ontap_select_deploy_administration_utility N/A
2025-02-05 CVE-2025-0167 When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. Curl, Bootstrap_os, Element_software, H300s_firmware, H410c_firmware, H410s_firmware, H500s_firmware, H610c_firmware, H610s_firmware, H615c_firmware, H700s_firmware, Ontap, Ontap_select_deploy_administration_utility, Ontap_tools, Solidfire_\&_hci_management_node, Solidfire_\&_hci_storage_node N/A
2025-02-05 CVE-2025-0665 libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. Curl, Bootstrap_os, H300s_firmware, H410c_firmware, H410s_firmware, H500s_firmware, H700s_firmware N/A
2025-05-28 CVE-2025-5025 libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. Curl N/A
2025-06-07 CVE-2025-5399 Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application. Curl N/A