Libcurl vulnerabilitiesRanked by how likely they are to be used.
Libcurl is made by Haxx. We track 61 published vulnerabilities in it, across 201 versions. None of them is on the list of flaws known to be exploited today. If you run Libcurl, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Libcurl vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Libcurl's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Libcurl flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 79%CVE-2023-38545Critical
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
- 50%CVE-2019-5436High
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
- 30%CVE-2015-3145High
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly...
- 22%CVE-2013-0249High
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers...
- 15%CVE-2016-5420High
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a...
- 15%CVE-2016-5419High
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
- 14%CVE-2015-3148Medium
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
- 13%CVE-2019-3822Critical
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.
Running Libcurl? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.
- Matched to
- Libcurl on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 61 published vulnerabilities listed under the name Libcurl, across 201 versions.
None of Libcurl's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Libcurl. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.