Debian Curl vulnerabilities

CVE-2024-2379 [MEDIUM] CVE-2024-2379: curl - libcurl skips the certificate verification for a QUIC connection under certain c... libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8.7.1-1) sid: resolved (fixed

CVE-2022-27779 [MEDIUM] CVE-2022-27779: curl - libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost... libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from bei

CVE-2023-27537 [MEDIUM] CVE-2023-27537: curl - A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data betw... A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-

CVE-2021-22923 [MEDIUM] CVE-2021-22923: curl - When curl is instructed to get content using the metalink feature, and a user na... When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the us

CVE-2025-10148 [MEDIUM] CVE-2025-10148: curl - curl's websocket code did not update the 32 bit mask pattern for each new outgo... curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (c

CVE-2013-1944 [MEDIUM] CVE-2013-1944: curl - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not pr... The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. Scope: local bookworm: resolved (fixed in 7.29.0-2.1) bullseye: resolved (fixed in 7.29.0-2.1) forky: resolved (fixed in 7.29.0-2.1) sid: resolved

CVE-2023-28320 [MEDIUM] CVE-2023-28320: curl - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl prov... A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protec

CVE-2022-43552 [MEDIUM] CVE-2022-43552: curl - A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tun... A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code pa

CVE-2010-0734 [MEDIUM] CVE-2010-0734: curl - content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does ... content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that reli

CVE-2023-27538 [MEDIUM] CVE-2023-27538: curl - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where i... An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were

CVE-2015-3153 [MEDIUM] CVE-2015-3153: curl - The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP h... The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents. Scope: local bookworm: resolved (fixed in 7.42.1-1) bullseye: resolved (fixed in 7.42.1-1) forky: resolved (fixed in 7.42.1-1) sid: resolve

CVE-2026-3783 [MEDIUM] CVE-2026-3783: curl - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer p... When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer

CVE-2014-8150 [MEDIUM] CVE-2014-8150: curl - CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when usin... CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL. Scope: local bookworm: resolved (fixed in 7.38.0-4) bullseye: resolved (fixed in 7.38.0-4) forky: resolved (fixed in 7.38.0-4) sid: resolved (fi

CVE-2025-14819 [MEDIUM] CVE-2025-14819: curl - When doing TLS related transfers with reused easy or multi handles and altering ... When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not. Scope:

CVE-2025-15079 [MEDIUM] CVE-2025-15079: curl - When doing SSH-based transfers using either SCP or SFTP, and setting the known_h... When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8.18.0~rc3-1) sid: resolved (fixed in 8.1

CVE-2025-14017 [MEDIUM] CVE-2025-14017: curl - When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing... When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. Scope: local bookworm:

CVE-2025-14524 [MEDIUM] CVE-2025-14524: curl - When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer p... When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8.18.0~rc2-1) sid: resolved (fixed in 8.18.0~rc2-1) trix

CVE-2011-2192 [MEDIUM] CVE-2011-2192: curl - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through ... The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests. Scope: local bookworm: resolved (fixed in 7.21.6-2) bullseye: resolved (fixed in 7.21.6-2) forky: resolved

CVE-2016-8617 [LOW] CVE-2016-8617: curl - The base64 encode function in curl before version 7.51.0 is prone to a buffer be... The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: resolved (fixed in 7.51.0-1

CVE-2023-46219 [MEDIUM] CVE-2023-46219: curl - When saving HSTS data to an excessively long file name, curl could end up removi... When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. Scope: local bookworm: resolved (fixed in 7.88.1-10+deb12u5) bullseye: open forky: resolved (fixed in 8.5.0-1) sid: resolved (fixed in 8.5.0-1) trixie: resolved (fixed in 8.5.