CVSS: 7.5EPSS: 0%CPEs: 162EXPL: 0CVE-2025-0725 – gzip integer overflow
https://notcve.org/view.php?id=CVE-2025-0725
05 Feb 2025 — When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overfl... • https://curl.se/docs/CVE-2025-0725.html •
CVSS: 5.0EPSS: 0%CPEs: 37EXPL: 0CVE-2025-0167 – netrc and default credential leak
https://notcve.org/view.php?id=CVE-2025-0167
05 Feb 2025 — When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. Thi... • https://curl.se/docs/CVE-2025-0167.html •
CVSS: 5.9EPSS: 0%CPEs: 197EXPL: 0CVE-2024-11053 – netrc and redirect credential leak
https://notcve.org/view.php?id=CVE-2024-11053
11 Dec 2024 — When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer o... • https://curl.se/docs/CVE-2024-11053.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •