Debian Curl vulnerabilities

CVE-2020-8169 [HIGH] CVE-2020-8169: curl - curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerabil... curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). Scope: local bookworm: resolved (fixed in 7.72.0-1) bullseye: resolved (fixed in 7.72.0-1) forky: resolved (fixed in 7.72.0-1) sid: resolved (fixed in 7.72.0-1) trixie: resolved (fixed in 7.72.0-1)

CVE-2022-27775 [HIGH] CVE-2022-27775: curl - An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vuln... An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead. Scope: local bookworm: resolved (fixed in 7.83.0-1) bullseye: resolved (fixed in 7.74.0-1.3+deb11u2) forky: resolved (fixed in 7.83.0-1) sid: resolved (fixe

CVE-2022-42916 [HIGH] CVE-2022-42916: curl - In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying... In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII coun

CVE-2025-5399 [HIGH] CVE-2025-5399: curl - Due to a mistake in libcurl's WebSocket code, a malicious server can send a part... Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application. Scope: local bookworm: resolved bullseye: resolved

CVE-2018-16890 [HIGH] CVE-2018-16890: curl - libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out... libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to acc

CVE-2022-27778 [HIGH] CVE-2022-27778: curl - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove th... A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. Scope: local bookworm: resolved (fixed in 7.83.1-1) bullseye: resolved forky: resolved (fixed in 7.83.1-1) sid: resolved (fixed in 7.83.1-1) trixie: resolved (fixed in 7.83.1-1)

CVE-2026-1965 [MEDIUM] CVE-2026-1965: curl - libcurl can in some circumstances reuse the wrong connection when asked to do an... libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that

CVE-2018-1000121 [HIGH] CVE-2018-1000121: curl - A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in... A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service Scope: local bookworm: resolved (fixed in 7.60.0-1) bullseye: resolved (fixed in 7.60.0-1) forky: resolved (fixed in 7.60.0-1) sid: resolved (fixed in 7.60.0-1) trixie: resolved (fixed in 7.60.0-1)

CVE-2022-27782 [HIGH] CVE-2022-27782: curl - libcurl would reuse a previously created connection even when a TLS or SSHrelate... libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themma

CVE-2025-9086 [HIGH] CVE-2025-9086: curl - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is ... 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the

CVE-2017-8818 [CRITICAL] CVE-2017-8818: curl - curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a de... curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library. Scope: local bookworm: resolved (fixed in 7.57.0-1) bullseye: resolved (fixed in 7.57.0-1) forky: resolved (fixe

CVE-2022-27781 [HIGH] CVE-2022-27781: curl - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest d... libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. Scope: local bookworm: resolved (fixed in 7.83.1-1) bullseye: resolved (f

CVE-2022-27780 [HIGH] CVE-2022-27780: curl - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when ... The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to cir

CVE-2007-3564 [HIGH] CVE-2007-3564: curl - libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SS... libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions. Scope: local bookworm: resolved (fixed in 7.16.4-1) bullseye: resolved (fixed in 7.16.4-1) forky: resolved (fixed in 7.16.4-1) sid: resolved (fixed in 7.16.4-1) trixie: resol

CVE-2013-2174 [MEDIUM] CVE-2013-2174: curl - Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in... Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character. Scope: local bookworm: resolved (fixed in 7.31.0-1) bullseye: resolved (fixed in 7.31.0-

CVE-2018-16842 [MEDIUM] CVE-2018-16842: curl - Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-r... Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. Scope: local bookworm: resolved (fixed in 7.62.0-1) bullseye: resolved (fixed in 7.62.0-1) forky: resolved (fixed in 7.62.0-1) sid: resolved (fixed in 7.62.0-1) trixie: resolved (fixed i

CVE-2016-8621 [MEDIUM] CVE-2016-8621: curl - The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an ou... The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: resolved (fixed in 7.51.0-1)

CVE-2006-1061 [HIGH] CVE-2006-1061: curl - Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remo... Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path. Scope: local bookworm: resolved (fixed in 7.15.3-1) bullseye: resolved (fixed in 7.15.3-1) forky: resolved (fixed in 7.15.3-1) sid: resolved (fixed in 7.15.3-1) trixie: resolved (fixed i

CVE-2005-3185 [HIGH] CVE-2005-3185: curl - Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) w... Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username. Scope: local bookworm: resolved (fixed in 7.15.0-1) bullseye: resolved (fixed in 7.15.0-1) for

CVE-2016-8625 [MEDIUM] CVE-2016-8625: curl - curl before version 7.51.0 uses outdated IDNA 2003 standard to handle Internatio... curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: