Debian Curl vulnerabilities

CVE-2025-5399 [HIGH] CVE-2025-5399: curl - Due to a mistake in libcurl's WebSocket code, a malicious server can send a part... Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application. Scope: local bookworm: resolved bullseye: resolved

CVE-2016-8624 [MEDIUM] CVE-2016-8624: curl - curl before version 7.51.0 doesn't parse the authority component of the URL corr... curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. Scope: loc

CVE-2022-27778 [HIGH] CVE-2022-27778: curl - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove th... A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. Scope: local bookworm: resolved (fixed in 7.83.1-1) bullseye: resolved forky: resolved (fixed in 7.83.1-1) sid: resolved (fixed in 7.83.1-1) trixie: resolved (fixed in 7.83.1-1)

CVE-2026-1965 [MEDIUM] CVE-2026-1965: curl - libcurl can in some circumstances reuse the wrong connection when asked to do an... libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that

CVE-2020-8169 [HIGH] CVE-2020-8169: curl - curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerabil... curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). Scope: local bookworm: resolved (fixed in 7.72.0-1) bullseye: resolved (fixed in 7.72.0-1) forky: resolved (fixed in 7.72.0-1) sid: resolved (fixed in 7.72.0-1) trixie: resolved (fixed in 7.72.0-1)

CVE-2018-1000121 [HIGH] CVE-2018-1000121: curl - A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in... A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service Scope: local bookworm: resolved (fixed in 7.60.0-1) bullseye: resolved (fixed in 7.60.0-1) forky: resolved (fixed in 7.60.0-1) sid: resolved (fixed in 7.60.0-1) trixie: resolved (fixed in 7.60.0-1)

CVE-2005-0490 [HIGH] CVE-2005-0490: curl - Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly o... Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth an

CVE-2022-27775 [HIGH] CVE-2022-27775: curl - An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vuln... An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead. Scope: local bookworm: resolved (fixed in 7.83.0-1) bullseye: resolved (fixed in 7.74.0-1.3+deb11u2) forky: resolved (fixed in 7.83.0-1) sid: resolved (fixe

CVE-2022-27782 [HIGH] CVE-2022-27782: curl - libcurl would reuse a previously created connection even when a TLS or SSHrelate... libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themma

CVE-2022-42916 [HIGH] CVE-2022-42916: curl - In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying... In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII coun

CVE-2025-0725 [HIGH] CVE-2025-0725: curl - When libcurl is asked to perform automatic gzip decompression of content-encoded... When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8.12.0+git20250209.89ed161+ds-1) sid: resolved

CVE-2015-3148 [MEDIUM] CVE-2015-3148: curl - cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Nego... cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request. Scope: local bookworm: resolved (fixed in 7.42.0-1) bullseye: resolved (fixed in 7.42.0-1) forky: resolved (fixed in 7.42.0-1) sid: resolved (fixed in 7.42.0-1) trixie: resolved (fixed in 7.42.0-1)

CVE-2016-8621 [MEDIUM] CVE-2016-8621: curl - The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an ou... The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: resolved (fixed in 7.51.0-1)

CVE-2017-8818 [CRITICAL] CVE-2017-8818: curl - curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a de... curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library. Scope: local bookworm: resolved (fixed in 7.57.0-1) bullseye: resolved (fixed in 7.57.0-1) forky: resolved (fixe

CVE-2013-2174 [MEDIUM] CVE-2013-2174: curl - Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in... Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character. Scope: local bookworm: resolved (fixed in 7.31.0-1) bullseye: resolved (fixed in 7.31.0-

CVE-2022-27780 [HIGH] CVE-2022-27780: curl - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when ... The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to cir

CVE-2007-3564 [HIGH] CVE-2007-3564: curl - libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SS... libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions. Scope: local bookworm: resolved (fixed in 7.16.4-1) bullseye: resolved (fixed in 7.16.4-1) forky: resolved (fixed in 7.16.4-1) sid: resolved (fixed in 7.16.4-1) trixie: resol

CVE-2018-16842 [MEDIUM] CVE-2018-16842: curl - Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-r... Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. Scope: local bookworm: resolved (fixed in 7.62.0-1) bullseye: resolved (fixed in 7.62.0-1) forky: resolved (fixed in 7.62.0-1) sid: resolved (fixed in 7.62.0-1) trixie: resolved (fixed i

CVE-2005-3185 [HIGH] CVE-2005-3185: curl - Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) w... Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username. Scope: local bookworm: resolved (fixed in 7.15.0-1) bullseye: resolved (fixed in 7.15.0-1) for

CVE-2006-1061 [HIGH] CVE-2006-1061: curl - Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remo... Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path. Scope: local bookworm: resolved (fixed in 7.15.3-1) bullseye: resolved (fixed in 7.15.3-1) forky: resolved (fixed in 7.15.3-1) sid: resolved (fixed in 7.15.3-1) trixie: resolved (fixed i