CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2025-5025 – No QUIC certificate pinning with wolfSSL
https://notcve.org/view.php?id=CVE-2025-5025
28 May 2025 — libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. • https://curl.se/docs/CVE-2025-5025.html •
CVSS: 7.4EPSS: 0%CPEs: 10EXPL: 0CVE-2025-4947 – QUIC certificate check skip with wolfSSL
https://notcve.org/view.php?id=CVE-2025-4947
28 May 2025 — libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks. • https://curl.se/docs/CVE-2025-4947.html •
CVSS: 7.5EPSS: 0%CPEs: 162EXPL: 0CVE-2025-0725 – gzip integer overflow
https://notcve.org/view.php?id=CVE-2025-0725
05 Feb 2025 — When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overfl... • https://curl.se/docs/CVE-2025-0725.html •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2025-0665 – eventfd double close
https://notcve.org/view.php?id=CVE-2025-0665
05 Feb 2025 — libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. • https://curl.se/docs/CVE-2025-0665.html • CWE-1341: Multiple Releases of Same Resource or Handle •
CVSS: 5.4EPSS: 0%CPEs: 37EXPL: 0CVE-2025-0167 – netrc and default credential leak
https://notcve.org/view.php?id=CVE-2025-0167
05 Feb 2025 — When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. Thi... • https://curl.se/docs/CVE-2025-0167.html •
CVSS: 5.9EPSS: 0%CPEs: 197EXPL: 0CVE-2024-11053 – netrc and redirect credential leak
https://notcve.org/view.php?id=CVE-2024-11053
11 Dec 2024 — When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer o... • https://curl.se/docs/CVE-2024-11053.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 37EXPL: 0CVE-2024-9681 – HSTS subdomain overwrites parent cache entry
https://notcve.org/view.php?id=CVE-2024-9681
06 Nov 2024 — When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS acces... • https://curl.se/docs/CVE-2024-9681.html •
CVSS: 7.8EPSS: 0%CPEs: 86EXPL: 0CVE-2024-8096 – OCSP stapling bypass with GnuTLS
https://notcve.org/view.php?id=CVE-2024-8096
11 Sep 2024 — When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being c... • https://curl.se/docs/CVE-2024-8096.json • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 2%CPEs: 95EXPL: 0CVE-2024-7264 – ASN.1 date parser overread
https://notcve.org/view.php?id=CVE-2024-7264
31 Jul 2024 — libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO... • https://curl.se/docs/CVE-2024-7264.html • CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6874 – macidn punycode buffer overread
https://notcve.org/view.php?id=CVE-2024-6874
24 Jul 2024 — libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string. La función API de U... • http://www.openwall.com/lists/oss-security/2024/07/24/2 •