Haxx vulnerabilitiesNone on the known-exploited list.
Haxx has 150 published vulnerabilities across 2 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Curl, with 111. If you run Haxx software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Haxx vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Haxx's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Haxx flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 79%CVE-2023-38545Critical
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
- 73%CVE-2011-3389Medium
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained...
- 64%CVE-2021-22901High
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.
- 58%CVE-2023-38039High
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.
- 50%CVE-2019-5436High
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
- 36%CVE-2022-32206Medium
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms.
- 31%CVE-2022-32205Medium
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them.
- 30%CVE-2015-3145High
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly...
- 22%CVE-2013-0249High
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers...
All Haxx products we track.
2 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
Running Haxx? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.
- Matched to
- Curl on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 150 published vulnerabilities across 2 products and 415 versions from Haxx.
None of Haxx's vulnerabilities is on the list of flaws known to be exploited today.
Curl, with 111 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Haxx products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.