CVSS: 7.5EPSS: 0%CPEs: 162EXPL: 0CVE-2025-0725 – gzip integer overflow
https://notcve.org/view.php?id=CVE-2025-0725
05 Feb 2025 — When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overfl... • https://curl.se/docs/CVE-2025-0725.html •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-0665 – eventfd double close
https://notcve.org/view.php?id=CVE-2025-0665
05 Feb 2025 — libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. • https://curl.se/docs/CVE-2025-0665.html • CWE-1341: Multiple Releases of Same Resource or Handle •
CVSS: 5.4EPSS: 0%CPEs: 37EXPL: 0CVE-2025-0167 – netrc and default credential leak
https://notcve.org/view.php?id=CVE-2025-0167
05 Feb 2025 — When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. Thi... • https://curl.se/docs/CVE-2025-0167.html •
CVSS: 5.9EPSS: 0%CPEs: 197EXPL: 0CVE-2024-11053 – netrc and redirect credential leak
https://notcve.org/view.php?id=CVE-2024-11053
11 Dec 2024 — When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer o... • https://curl.se/docs/CVE-2024-11053.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 37EXPL: 0CVE-2024-9681 – HSTS subdomain overwrites parent cache entry
https://notcve.org/view.php?id=CVE-2024-9681
06 Nov 2024 — When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS acces... • https://curl.se/docs/CVE-2024-9681.html •
CVSS: 7.8EPSS: 0%CPEs: 86EXPL: 0CVE-2024-8096 – OCSP stapling bypass with GnuTLS
https://notcve.org/view.php?id=CVE-2024-8096
11 Sep 2024 — When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being c... • https://curl.se/docs/CVE-2024-8096.json • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 1%CPEs: 95EXPL: 0CVE-2024-7264 – ASN.1 date parser overread
https://notcve.org/view.php?id=CVE-2024-7264
31 Jul 2024 — libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO... • https://curl.se/docs/CVE-2024-7264.html • CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6874 – macidn punycode buffer overread
https://notcve.org/view.php?id=CVE-2024-6874
24 Jul 2024 — libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string. La función API de U... • http://www.openwall.com/lists/oss-security/2024/07/24/2 •
CVSS: 7.8EPSS: 1%CPEs: 4EXPL: 0CVE-2024-6197 – freeing stack buffer in utf8asn1str
https://notcve.org/view.php?id=CVE-2024-6197
24 Jul 2024 — libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. • http://www.openwall.com/lists/oss-security/2024/07/24/1 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-2466 – TLS certificate check bypass with mbedTLS
https://notcve.org/view.php?id=CVE-2024-2466
27 Mar 2024 — libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). libcurl no verificó el certificado del servidor de las conexiones TLS realizadas a un host especificado como dirección IP, cuando... • http://www.openwall.com/lists/oss-security/2024/03/27/4 • CWE-297: Improper Validation of Certificate with Host Mismatch •