[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPUk9Ssy0rb577uNFLLMcOD559yBVgiM5EYYdjTOwtxs":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":27,"kevVulnerabilities":89,"topProductsByCves":90,"seoMetadata":93,"meta":102},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":26},13232,"haxx",2,150,0,415,"2025-02-05","h",[16,21],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},53757,"curl",214,111,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":13},53758,"libcurl",201,61,"Haxx is a technology vendor with 2 tracked products and 150 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[28,37,45,52,58,64,70,74,79,84],{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":35,"epssScore":36},"CVE-2023-38545","This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.","2023-10-18",9.8,"v3.1","Critical",false,0.78689,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":42,"severity":43,"isKev":35,"epssScore":44},"CVE-2011-3389","The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.","2011-09-06",4.3,"v2","Medium",0.73327,{"cveId":46,"description":47,"publishedDate":48,"cvssScore":49,"cvssVersion":33,"severity":50,"isKev":35,"epssScore":51},"CVE-2021-22901","curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP\u002F1.1 connection or multiplexed HTTP\u002F2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.","2021-06-11",8.1,"High",0.63531,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":56,"cvssVersion":33,"severity":50,"isKev":35,"epssScore":57},"CVE-2023-38039","When curl retrieves an HTTP response, it stores the incoming headers so that\nthey can be accessed later via the libcurl headers API.\n\nHowever, curl did not have a limit in how many or how large headers it would\naccept in a response, allowing a malicious server to stream an endless series\nof headers and eventually cause curl to run out of heap memory.","2023-09-15",7.5,0.58068,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":33,"severity":50,"isKev":35,"epssScore":63},"CVE-2019-5436","A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.","2019-05-28",7.8,0.49739,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":33,"severity":43,"isKev":35,"epssScore":69},"CVE-2022-32206","curl \u003C 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.","2022-07-07",6.5,0.36348,{"cveId":71,"description":72,"publishedDate":67,"cvssScore":41,"cvssVersion":33,"severity":43,"isKev":35,"epssScore":73},"CVE-2022-32205","A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl \u003C 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method.",0.31497,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":56,"cvssVersion":42,"severity":50,"isKev":35,"epssScore":78},"CVE-2015-3145","The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","2015-04-24",0.30467,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":56,"cvssVersion":42,"severity":50,"isKev":35,"epssScore":83},"CVE-2013-0249","Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib\u002Fcurl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","2013-03-08",0.21643,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":68,"cvssVersion":33,"severity":43,"isKev":35,"epssScore":88},"CVE-2024-7264","libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https:\u002F\u002Fcurl.se\u002Flibcurl\u002Fc\u002FCURLINFO_CERTINFO.html) is used.","2024-07-31",0.20202,[],[91,92],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":13},{"title":94,"metaDescription":95,"keywords":96,"structuredData":97},"Haxx - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Haxx covering 2 products with 150 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Haxx vulnerabilities, Haxx security, Haxx CVE, Haxx threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":98,"@type":99,"name":100,"description":95,"url":101},"https:\u002F\u002Fschema.org","Organization","Haxx","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fhaxx",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":103,"apiVersion":104},"2026-10-17T00:10:46.384Z","3.0"]