CVSS: 7.5EPSS: 0%CPEs: 162EXPL: 0CVE-2025-0725 – gzip integer overflow
https://notcve.org/view.php?id=CVE-2025-0725
05 Feb 2025 — When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overfl... • https://curl.se/docs/CVE-2025-0725.html •
CVSS: 5.4EPSS: 0%CPEs: 37EXPL: 0CVE-2025-0167 – netrc and default credential leak
https://notcve.org/view.php?id=CVE-2025-0167
05 Feb 2025 — When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. Thi... • https://curl.se/docs/CVE-2025-0167.html •
CVSS: 5.9EPSS: 0%CPEs: 197EXPL: 0CVE-2024-11053 – netrc and redirect credential leak
https://notcve.org/view.php?id=CVE-2024-11053
11 Dec 2024 — When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer o... • https://curl.se/docs/CVE-2024-11053.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 37EXPL: 0CVE-2024-9681 – HSTS subdomain overwrites parent cache entry
https://notcve.org/view.php?id=CVE-2024-9681
06 Nov 2024 — When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS acces... • https://curl.se/docs/CVE-2024-9681.html •
CVSS: 7.8EPSS: 0%CPEs: 86EXPL: 0CVE-2024-8096 – OCSP stapling bypass with GnuTLS
https://notcve.org/view.php?id=CVE-2024-8096
11 Sep 2024 — When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being c... • https://curl.se/docs/CVE-2024-8096.json • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 1%CPEs: 95EXPL: 0CVE-2024-7264 – ASN.1 date parser overread
https://notcve.org/view.php?id=CVE-2024-7264
31 Jul 2024 — libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO... • https://curl.se/docs/CVE-2024-7264.html • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 2%CPEs: 4EXPL: 0CVE-2024-6197 – freeing stack buffer in utf8asn1str
https://notcve.org/view.php?id=CVE-2024-6197
24 Jul 2024 — libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. • http://www.openwall.com/lists/oss-security/2024/07/24/1 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-2466 – TLS certificate check bypass with mbedTLS
https://notcve.org/view.php?id=CVE-2024-2466
27 Mar 2024 — libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). libcurl no verificó el certificado del servidor de las conexiones TLS realizadas a un host especificado como dirección IP, cuando... • http://www.openwall.com/lists/oss-security/2024/03/27/4 • CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 6.3EPSS: 1%CPEs: 1EXPL: 0CVE-2024-2379 – QUIC certificate check bypass with wolfSSL
https://notcve.org/view.php?id=CVE-2024-2379
27 Mar 2024 — libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems. libcurl omite la verificación del certificado para una conexión QUIC bajo ciertas condiciones, cuando está diseñado para usar wolfSSL. Si se le indica que utilice un cifrado o curva desconocido/incorrecto, la ruta de error omite accidentalm... • http://www.openwall.com/lists/oss-security/2024/03/27/2 • CWE-295: Improper Certificate Validation •
CVSS: 5.3EPSS: 1%CPEs: 16EXPL: 0CVE-2024-2004 – Usage of disabled protocol
https://notcve.org/view.php?id=CVE-2024-2004
27 Mar 2024 — When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and th... • http://www.openwall.com/lists/oss-security/2024/03/27/1 • CWE-115: Misinterpretation of Input CWE-436: Interpretation Conflict •