Debian Curl vulnerabilities

CVE-2022-32205 [MEDIUM] CVE-2022-32205: curl - A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTT... A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy

CVE-2016-3739 [MEDIUM] CVE-2016-3739: curl - The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_conne... The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate. Scope: local bookworm: resolved (fixed in 7.50.1-1)

CVE-2015-3237 [MEDIUM] CVE-2015-3237: curl - The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows ... The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values. Scope: local bookworm: resolved (fixed in 7.43.0-1) bullseye: resolved (fixed in 7.43.0-1) forky: resolved (fixed in 7.43.0-1) sid

CVE-2016-8616 [LOW] CVE-2016-8616: curl - A flaw was found in curl before version 7.51.0 When re-using a connection, curl ... A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the cas

CVE-2023-27536 [MEDIUM] CVE-2023-27536: curl - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection r... An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized a

CVE-2022-27774 [MEDIUM] CVE-2022-27774: curl - An insufficiently protected credentials vulnerability exists in curl 4.9 to and ... An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers. Scope: local bookworm: resolved (fixed in 7.83.0-1) b

CVE-2014-0138 [MEDIUM] CVE-2014-0138: curl - The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) S... The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015. Scope: local bookworm: resolved (fixed in 7.36.0-1) bul

CVE-2015-3236 [MEDIUM] CVE-2015-3236: curl - cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication creden... cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors. Scope: local bookworm: resolved (fixed in 7.43.0-1) bullseye: resolved (fi

CVE-2021-22876 [MEDIUM] CVE-2021-22876: curl - curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Pers... curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive dat

CVE-2017-2629 [MEDIUM] CVE-2017-2629: curl - curl before 7.53.0 has an incorrect TLS Certificate Status Request extension fea... curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not

CVE-2023-23915 [MEDIUM] CVE-2023-23915: curl - A cleartext transmission of sensitive information vulnerability exists in curl <... A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would ho

CVE-2024-8096 [MEDIUM] CVE-2024-8096: curl - When curl is told to use the Certificate Status Request TLS extension, often ref... When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad c

CVE-2023-28321 [MEDIUM] CVE-2023-28321: curl - An improper certificate validation vulnerability exists in curl <v8.1.0 in the w... An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (Internatio

CVE-2025-13034 [MEDIUM] CVE-2025-13034: curl - When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` wit... When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the c

CVE-2014-3613 [MEDIUM] CVE-2014-3613: curl - cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie d... cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1. Scope: local bookworm: resolved (fixed in 7.38.0-1) bullseye: resolved (fixed in 7.38.0-1) forky: res

CVE-2014-3620 [MEDIUM] CVE-2014-3620: curl - cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin ... cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain. Scope: local bookworm: resolved (fixed in 7.38.0-1) bullseye: resolved (fixed in 7.38.0-1) forky: resolved (fixed in 7.38.0-1) sid: resolved (fixed in 7.38.0-1) trixie: resolved (fixed in 7.38.0-1)

CVE-2025-4947 [MEDIUM] CVE-2025-4947: curl - libcurl accidentally skips the certificate verification for QUIC connections whe... libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8.14.0-1) sid: resolved (fixed in 8.14.0-1) trixie: resolved (fixed in 8.14.0-1)

CVE-2014-0139 [MEDIUM] CVE-2014-0139: curl - cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gsk... cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Scope: local bookworm

CVE-2022-35260 [MEDIUM] CVE-2022-35260: curl - curl can be told to parse a `.netrc` file for credentials. If that file endsin a... curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different ou

CVE-2023-23916 [MEDIUM] CVE-2023-23916: curl - An allocation of resources without limits or throttling vulnerability exists in ... An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header