CVE-2017-8816 — Integer Overflow or Wraparound in Curl
Severity
9.8CRITICALNVD
EPSS
0.5%
top 36.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 29
Latest updateApr 16
Description
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages4 packages
Also affects: Debian Linux 8.0, 9.0
🔴Vulnerability Details
6VulDB▶
cURL/libcURL up to 7.56.x on 32-bit NTLM Authentication integer overflow (RHSA-2018:3558 / Nessus ID 104861)↗2026-04-16
📋Vendor Advisories
5Apple▶
CVE-2017-8816: macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan↗2018-03-29
Apple▶
CVE-2017-8816: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan↗2018-01-23
Debian▶
CVE-2017-8816: curl - The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit plat...↗2017