Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:generic/curl.se/curl@8.2.0
Typegeneric
Namespacecurl.se
Namecurl
Version8.2.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version8.20.0
Latest_non_vulnerable_version8.20.0
Affected_by_vulnerabilities
0
url VCID-1dw3-33ju-jkbs
vulnerability_id VCID-1dw3-33ju-jkbs
summary When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0725.json
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0725.json
1
reference_url https://curl.se/docs/CVE-2025-0725.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-05T14:33:50Z/
url https://curl.se/docs/CVE-2025-0725.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2956023
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-05T14:33:50Z/
url https://hackerone.com/reports/2956023
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2343899
reference_id 2343899
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2343899
5
reference_url https://curl.se/docs/CVE-2025-0725.json
reference_id CVE-2025-0725.json
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-05T14:33:50Z/
url https://curl.se/docs/CVE-2025-0725.json
fixed_packages
0
url pkg:generic/curl.se/curl@8.12.0
purl pkg:generic/curl.se/curl@8.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-21ff-tazv-9ud3
1
vulnerability VCID-39qh-jayw-g3dh
2
vulnerability VCID-5un8-xymy-37bt
3
vulnerability VCID-7wqd-99h2-e7hk
4
vulnerability VCID-bcuq-n4vb-k7f3
5
vulnerability VCID-bp56-gy66-mqae
6
vulnerability VCID-ezve-gc2h-qyga
7
vulnerability VCID-f9nm-d5ax-qkcb
8
vulnerability VCID-fcb7-8163-muf4
9
vulnerability VCID-g7ux-4vz2-ckfg
10
vulnerability VCID-gux4-dncg-h7a6
11
vulnerability VCID-hhms-2hg6-nke9
12
vulnerability VCID-ns6z-wp2x-fkdq
13
vulnerability VCID-p155-gbtu-abg1
14
vulnerability VCID-secz-78pt-dben
15
vulnerability VCID-t45k-skv6-cfg2
16
vulnerability VCID-v82t-s9e1-2fbw
17
vulnerability VCID-w8ff-vxga-8qcz
18
vulnerability VCID-wgur-psum-pbck
19
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.12.0
aliases CVE-2025-0725
risk_score 1.8
exploitability 0.5
weighted_severity 3.6
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1dw3-33ju-jkbs
1
url VCID-21ff-tazv-9ud3
vulnerability_id VCID-21ff-tazv-9ud3
summary When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14524.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14524.json
1
reference_url https://curl.se/docs/CVE-2025-14524.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-09T19:24:54Z/
url https://curl.se/docs/CVE-2025-14524.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3459417
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-09T19:24:54Z/
url https://hackerone.com/reports/3459417
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2426407
reference_id 2426407
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2426407
5
reference_url https://curl.se/docs/CVE-2025-14524.json
reference_id CVE-2025-14524.json
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-09T19:24:54Z/
url https://curl.se/docs/CVE-2025-14524.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.18.0
purl pkg:generic/curl.se/curl@8.18.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39qh-jayw-g3dh
1
vulnerability VCID-5un8-xymy-37bt
2
vulnerability VCID-9vbs-w124-q3au
3
vulnerability VCID-bcuq-n4vb-k7f3
4
vulnerability VCID-f9nm-d5ax-qkcb
5
vulnerability VCID-fxgf-t3ue-6qhf
6
vulnerability VCID-g7ux-4vz2-ckfg
7
vulnerability VCID-hhms-2hg6-nke9
8
vulnerability VCID-secz-78pt-dben
9
vulnerability VCID-w8ff-vxga-8qcz
10
vulnerability VCID-wgur-psum-pbck
11
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.18.0
aliases CVE-2025-14524
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-21ff-tazv-9ud3
2
url VCID-39qh-jayw-g3dh
vulnerability_id VCID-39qh-jayw-g3dh
summary curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1965.json
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1965.json
1
reference_url https://curl.se/docs/CVE-2026-1965.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-11T14:31:56Z/
url https://curl.se/docs/CVE-2026-1965.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2446448
reference_id 2446448
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2446448
4
reference_url https://curl.se/docs/CVE-2026-1965.json
reference_id CVE-2026-1965.json
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-11T14:31:56Z/
url https://curl.se/docs/CVE-2026-1965.json
5
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.19.0
purl pkg:generic/curl.se/curl@8.19.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5un8-xymy-37bt
1
vulnerability VCID-9vbs-w124-q3au
2
vulnerability VCID-bcuq-n4vb-k7f3
3
vulnerability VCID-f9nm-d5ax-qkcb
4
vulnerability VCID-g7ux-4vz2-ckfg
5
vulnerability VCID-secz-78pt-dben
6
vulnerability VCID-w8ff-vxga-8qcz
7
vulnerability VCID-wgur-psum-pbck
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.19.0
aliases CVE-2026-1965
risk_score 3.0
exploitability 0.5
weighted_severity 6.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-39qh-jayw-g3dh
3
url VCID-3p2z-61gq-muhs
vulnerability_id VCID-3p2z-61gq-muhs
summary When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
references
0
reference_url https://curl.se/docs/CVE-2025-0167.html
reference_id
reference_type
scores
0
value 3.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-05T15:52:41Z/
url https://curl.se/docs/CVE-2025-0167.html
1
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2
reference_url https://hackerone.com/reports/2917232
reference_id
reference_type
scores
0
value 3.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-05T15:52:41Z/
url https://hackerone.com/reports/2917232
3
reference_url https://curl.se/docs/CVE-2025-0167.json
reference_id CVE-2025-0167.json
reference_type
scores
0
value 3.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-05T15:52:41Z/
url https://curl.se/docs/CVE-2025-0167.json
fixed_packages
0
url pkg:generic/curl.se/curl@8.12.0
purl pkg:generic/curl.se/curl@8.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-21ff-tazv-9ud3
1
vulnerability VCID-39qh-jayw-g3dh
2
vulnerability VCID-5un8-xymy-37bt
3
vulnerability VCID-7wqd-99h2-e7hk
4
vulnerability VCID-bcuq-n4vb-k7f3
5
vulnerability VCID-bp56-gy66-mqae
6
vulnerability VCID-ezve-gc2h-qyga
7
vulnerability VCID-f9nm-d5ax-qkcb
8
vulnerability VCID-fcb7-8163-muf4
9
vulnerability VCID-g7ux-4vz2-ckfg
10
vulnerability VCID-gux4-dncg-h7a6
11
vulnerability VCID-hhms-2hg6-nke9
12
vulnerability VCID-ns6z-wp2x-fkdq
13
vulnerability VCID-p155-gbtu-abg1
14
vulnerability VCID-secz-78pt-dben
15
vulnerability VCID-t45k-skv6-cfg2
16
vulnerability VCID-v82t-s9e1-2fbw
17
vulnerability VCID-w8ff-vxga-8qcz
18
vulnerability VCID-wgur-psum-pbck
19
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.12.0
aliases CVE-2025-0167
risk_score 1.1
exploitability 0.5
weighted_severity 2.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3p2z-61gq-muhs
4
url VCID-5un8-xymy-37bt
vulnerability_id VCID-5un8-xymy-37bt
summary curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5773.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5773.json
1
reference_url https://curl.se/docs/CVE-2026-5773.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:45:00Z/
url https://curl.se/docs/CVE-2026-5773.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3650689
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:45:00Z/
url https://hackerone.com/reports/3650689
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461201
reference_id 2461201
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461201
5
reference_url https://curl.se/docs/CVE-2026-5773.json
reference_id CVE-2026-5773.json
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:45:00Z/
url https://curl.se/docs/CVE-2026-5773.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:12916
reference_id RHSA-2026:12916
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:12916
fixed_packages
0
url pkg:generic/curl.se/curl@8.20.0
purl pkg:generic/curl.se/curl@8.20.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.20.0
aliases CVE-2026-5773
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5un8-xymy-37bt
5
url VCID-6ggz-pa5t-77c4
vulnerability_id VCID-6ggz-pa5t-77c4
summary When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9681.json
reference_id
reference_type
scores
0
value 3.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9681.json
1
reference_url https://curl.se/docs/CVE-2024-9681.html
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-06T16:16:59Z/
url https://curl.se/docs/CVE-2024-9681.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2764830
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-06T16:16:59Z/
url https://hackerone.com/reports/2764830
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1086804
reference_id 1086804
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1086804
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2322969
reference_id 2322969
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2322969
6
reference_url https://curl.se/docs/CVE-2024-9681.json
reference_id CVE-2024-9681.json
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-06T16:16:59Z/
url https://curl.se/docs/CVE-2024-9681.json
fixed_packages
0
url pkg:generic/curl.se/curl@8.11.0
purl pkg:generic/curl.se/curl@8.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-7wqd-99h2-e7hk
6
vulnerability VCID-bcuq-n4vb-k7f3
7
vulnerability VCID-bp56-gy66-mqae
8
vulnerability VCID-ezve-gc2h-qyga
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-g7ux-4vz2-ckfg
12
vulnerability VCID-gux4-dncg-h7a6
13
vulnerability VCID-hhms-2hg6-nke9
14
vulnerability VCID-ns6z-wp2x-fkdq
15
vulnerability VCID-p155-gbtu-abg1
16
vulnerability VCID-secz-78pt-dben
17
vulnerability VCID-t45k-skv6-cfg2
18
vulnerability VCID-u1p8-s8vm-3yer
19
vulnerability VCID-v82t-s9e1-2fbw
20
vulnerability VCID-w8ff-vxga-8qcz
21
vulnerability VCID-wgur-psum-pbck
22
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.11.0
aliases CVE-2024-9681
risk_score 1.8
exploitability 0.5
weighted_severity 3.5
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6ggz-pa5t-77c4
6
url VCID-7wqd-99h2-e7hk
vulnerability_id VCID-7wqd-99h2-e7hk
summary When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14017.json
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14017.json
1
reference_url https://curl.se/docs/CVE-2025-14017.html
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-01-16T15:39:09Z/
url https://curl.se/docs/CVE-2025-14017.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2427870
reference_id 2427870
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2427870
4
reference_url https://curl.se/docs/CVE-2025-14017.json
reference_id CVE-2025-14017.json
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-01-16T15:39:09Z/
url https://curl.se/docs/CVE-2025-14017.json
5
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.18.0
purl pkg:generic/curl.se/curl@8.18.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39qh-jayw-g3dh
1
vulnerability VCID-5un8-xymy-37bt
2
vulnerability VCID-9vbs-w124-q3au
3
vulnerability VCID-bcuq-n4vb-k7f3
4
vulnerability VCID-f9nm-d5ax-qkcb
5
vulnerability VCID-fxgf-t3ue-6qhf
6
vulnerability VCID-g7ux-4vz2-ckfg
7
vulnerability VCID-hhms-2hg6-nke9
8
vulnerability VCID-secz-78pt-dben
9
vulnerability VCID-w8ff-vxga-8qcz
10
vulnerability VCID-wgur-psum-pbck
11
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.18.0
aliases CVE-2025-14017
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7wqd-99h2-e7hk
7
url VCID-85qb-zec7-subc
vulnerability_id VCID-85qb-zec7-subc
summary When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-46219.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-46219.json
1
reference_url https://curl.se/docs/CVE-2023-46219.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:01:11Z/
url https://curl.se/docs/CVE-2023-46219.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2236133
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:01:11Z/
url https://hackerone.com/reports/2236133
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057645
reference_id 1057645
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057645
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2252034
reference_id 2252034
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2252034
6
reference_url https://www.debian.org/security/2023/dsa-5587
reference_id dsa-5587
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:01:11Z/
url https://www.debian.org/security/2023/dsa-5587
7
reference_url https://security.gentoo.org/glsa/202409-20
reference_id GLSA-202409-20
reference_type
scores
url https://security.gentoo.org/glsa/202409-20
8
reference_url https://security.netapp.com/advisory/ntap-20240119-0007/
reference_id ntap-20240119-0007
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:01:11Z/
url https://security.netapp.com/advisory/ntap-20240119-0007/
9
reference_url https://access.redhat.com/errata/RHSA-2024:1316
reference_id RHSA-2024:1316
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1316
10
reference_url https://access.redhat.com/errata/RHSA-2024:1317
reference_id RHSA-2024:1317
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1317
11
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
reference_id UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T20:01:11Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
fixed_packages
0
url pkg:generic/curl.se/curl@8.5.0
purl pkg:generic/curl.se/curl@8.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-bcuq-n4vb-k7f3
8
vulnerability VCID-bp56-gy66-mqae
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-ffmg-djmk-57hn
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-h7v8-bg58-mkhu
15
vulnerability VCID-hhms-2hg6-nke9
16
vulnerability VCID-jnq1-hk6d-b3a3
17
vulnerability VCID-ke97-b9rb-5bfd
18
vulnerability VCID-kq38-7s5x-nqaz
19
vulnerability VCID-p155-gbtu-abg1
20
vulnerability VCID-secz-78pt-dben
21
vulnerability VCID-u1p8-s8vm-3yer
22
vulnerability VCID-v82t-s9e1-2fbw
23
vulnerability VCID-w8ff-vxga-8qcz
24
vulnerability VCID-wgur-psum-pbck
25
vulnerability VCID-y41p-tgpa-m7cs
26
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.5.0
aliases CVE-2023-46219
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-85qb-zec7-subc
8
url VCID-bcuq-n4vb-k7f3
vulnerability_id VCID-bcuq-n4vb-k7f3
summary curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-7168.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-7168.json
1
reference_url https://curl.se/docs/CVE-2026-7168.html
reference_id
reference_type
scores
0
value Medium
scoring_system cvssv3.1
scoring_elements
url https://curl.se/docs/CVE-2026-7168.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3697719
reference_id
reference_type
scores
url https://hackerone.com/reports/3697719
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2476979
reference_id 2476979
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2476979
5
reference_url https://access.redhat.com/errata/RHSA-2026:19106
reference_id RHSA-2026:19106
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:19106
fixed_packages
0
url pkg:generic/curl.se/curl@8.20.0
purl pkg:generic/curl.se/curl@8.20.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.20.0
aliases CVE-2026-7168
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bcuq-n4vb-k7f3
9
url VCID-f9nm-d5ax-qkcb
vulnerability_id VCID-f9nm-d5ax-qkcb
summary curl: libcurl: Credential leak via reused proxy connection during HTTP redirects
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6429.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6429.json
1
reference_url https://curl.se/docs/CVE-2026-6429.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T14:03:52Z/
url https://curl.se/docs/CVE-2026-6429.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3677759
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T14:03:52Z/
url https://hackerone.com/reports/3677759
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461205
reference_id 2461205
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461205
5
reference_url https://curl.se/docs/CVE-2026-6429.json
reference_id CVE-2026-6429.json
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T14:03:52Z/
url https://curl.se/docs/CVE-2026-6429.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:12916
reference_id RHSA-2026:12916
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:12916
fixed_packages
0
url pkg:generic/curl.se/curl@8.20.0
purl pkg:generic/curl.se/curl@8.20.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.20.0
aliases CVE-2026-6429
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f9nm-d5ax-qkcb
10
url VCID-fcb7-8163-muf4
vulnerability_id VCID-fcb7-8163-muf4
summary When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-15224.json
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-15224.json
1
reference_url https://curl.se/docs/CVE-2025-15224.html
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:38:20Z/
url https://curl.se/docs/CVE-2025-15224.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3480925
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:38:20Z/
url https://hackerone.com/reports/3480925
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2426410
reference_id 2426410
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2426410
5
reference_url https://curl.se/docs/CVE-2025-15224.json
reference_id CVE-2025-15224.json
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:38:20Z/
url https://curl.se/docs/CVE-2025-15224.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.18.0
purl pkg:generic/curl.se/curl@8.18.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39qh-jayw-g3dh
1
vulnerability VCID-5un8-xymy-37bt
2
vulnerability VCID-9vbs-w124-q3au
3
vulnerability VCID-bcuq-n4vb-k7f3
4
vulnerability VCID-f9nm-d5ax-qkcb
5
vulnerability VCID-fxgf-t3ue-6qhf
6
vulnerability VCID-g7ux-4vz2-ckfg
7
vulnerability VCID-hhms-2hg6-nke9
8
vulnerability VCID-secz-78pt-dben
9
vulnerability VCID-w8ff-vxga-8qcz
10
vulnerability VCID-wgur-psum-pbck
11
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.18.0
aliases CVE-2025-15224
risk_score 2.1
exploitability 0.5
weighted_severity 4.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fcb7-8163-muf4
11
url VCID-ffmg-djmk-57hn
vulnerability_id VCID-ffmg-djmk-57hn
summary When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2004.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2004.json
1
reference_url https://curl.se/docs/CVE-2024-2004.html
reference_id
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://curl.se/docs/CVE-2024-2004.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2384833
reference_id
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://hackerone.com/reports/2384833
4
reference_url http://www.openwall.com/lists/oss-security/2024/03/27/1
reference_id 1
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url http://www.openwall.com/lists/oss-security/2024/03/27/1
5
reference_url http://seclists.org/fulldisclosure/2024/Jul/18
reference_id 18
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url http://seclists.org/fulldisclosure/2024/Jul/18
6
reference_url http://seclists.org/fulldisclosure/2024/Jul/19
reference_id 19
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url http://seclists.org/fulldisclosure/2024/Jul/19
7
reference_url http://seclists.org/fulldisclosure/2024/Jul/20
reference_id 20
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url http://seclists.org/fulldisclosure/2024/Jul/20
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2270500
reference_id 2270500
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2270500
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
reference_id 2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
10
reference_url https://curl.se/docs/CVE-2024-2004.json
reference_id CVE-2024-2004.json
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://curl.se/docs/CVE-2024-2004.json
11
reference_url https://security.gentoo.org/glsa/202409-20
reference_id GLSA-202409-20
reference_type
scores
url https://security.gentoo.org/glsa/202409-20
12
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
reference_id GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
13
reference_url https://support.apple.com/kb/HT214118
reference_id HT214118
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://support.apple.com/kb/HT214118
14
reference_url https://support.apple.com/kb/HT214119
reference_id HT214119
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://support.apple.com/kb/HT214119
15
reference_url https://support.apple.com/kb/HT214120
reference_id HT214120
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://support.apple.com/kb/HT214120
16
reference_url https://security.netapp.com/advisory/ntap-20240524-0006/
reference_id ntap-20240524-0006
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/
url https://security.netapp.com/advisory/ntap-20240524-0006/
17
reference_url https://access.redhat.com/errata/RHSA-2024:2693
reference_id RHSA-2024:2693
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2693
18
reference_url https://access.redhat.com/errata/RHSA-2024:2694
reference_id RHSA-2024:2694
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2694
fixed_packages
0
url pkg:generic/curl.se/curl@8.7.0
purl pkg:generic/curl.se/curl@8.7.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-85ne-e7gm-5ua9
8
vulnerability VCID-bcuq-n4vb-k7f3
9
vulnerability VCID-bp56-gy66-mqae
10
vulnerability VCID-f9nm-d5ax-qkcb
11
vulnerability VCID-fcb7-8163-muf4
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-hhms-2hg6-nke9
15
vulnerability VCID-kq38-7s5x-nqaz
16
vulnerability VCID-p155-gbtu-abg1
17
vulnerability VCID-secz-78pt-dben
18
vulnerability VCID-u1p8-s8vm-3yer
19
vulnerability VCID-v82t-s9e1-2fbw
20
vulnerability VCID-w8ff-vxga-8qcz
21
vulnerability VCID-wgur-psum-pbck
22
vulnerability VCID-y41p-tgpa-m7cs
23
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.7.0
aliases CVE-2024-2004
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ffmg-djmk-57hn
12
url VCID-g7ux-4vz2-ckfg
vulnerability_id VCID-g7ux-4vz2-ckfg
summary curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5545.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-5545.json
1
reference_url https://curl.se/docs/CVE-2026-5545.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:46:36Z/
url https://curl.se/docs/CVE-2026-5545.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3642555
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:46:36Z/
url https://hackerone.com/reports/3642555
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461204
reference_id 2461204
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461204
5
reference_url https://curl.se/docs/CVE-2026-5545.json
reference_id CVE-2026-5545.json
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:46:36Z/
url https://curl.se/docs/CVE-2026-5545.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:12916
reference_id RHSA-2026:12916
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:12916
fixed_packages
0
url pkg:generic/curl.se/curl@8.20.0
purl pkg:generic/curl.se/curl@8.20.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.20.0
aliases CVE-2026-5545
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g7ux-4vz2-ckfg
13
url VCID-gux4-dncg-h7a6
vulnerability_id VCID-gux4-dncg-h7a6
summary When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14819.json
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14819.json
1
reference_url https://curl.se/docs/CVE-2025-14819.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T15:00:02Z/
url https://curl.se/docs/CVE-2025-14819.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2426408
reference_id 2426408
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2426408
4
reference_url https://curl.se/docs/CVE-2025-14819.json
reference_id CVE-2025-14819.json
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T15:00:02Z/
url https://curl.se/docs/CVE-2025-14819.json
5
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.18.0
purl pkg:generic/curl.se/curl@8.18.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39qh-jayw-g3dh
1
vulnerability VCID-5un8-xymy-37bt
2
vulnerability VCID-9vbs-w124-q3au
3
vulnerability VCID-bcuq-n4vb-k7f3
4
vulnerability VCID-f9nm-d5ax-qkcb
5
vulnerability VCID-fxgf-t3ue-6qhf
6
vulnerability VCID-g7ux-4vz2-ckfg
7
vulnerability VCID-hhms-2hg6-nke9
8
vulnerability VCID-secz-78pt-dben
9
vulnerability VCID-w8ff-vxga-8qcz
10
vulnerability VCID-wgur-psum-pbck
11
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.18.0
aliases CVE-2025-14819
risk_score 3.0
exploitability 0.5
weighted_severity 6.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gux4-dncg-h7a6
14
url VCID-hhms-2hg6-nke9
vulnerability_id VCID-hhms-2hg6-nke9
summary curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-3783.json
reference_id
reference_type
scores
0
value 5.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-3783.json
1
reference_url https://curl.se/docs/CVE-2026-3783.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-11T14:25:28Z/
url https://curl.se/docs/CVE-2026-3783.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3583983
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-11T14:25:28Z/
url https://hackerone.com/reports/3583983
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2446450
reference_id 2446450
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2446450
5
reference_url https://curl.se/docs/CVE-2026-3783.json
reference_id CVE-2026-3783.json
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-11T14:25:28Z/
url https://curl.se/docs/CVE-2026-3783.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.19.0
purl pkg:generic/curl.se/curl@8.19.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5un8-xymy-37bt
1
vulnerability VCID-9vbs-w124-q3au
2
vulnerability VCID-bcuq-n4vb-k7f3
3
vulnerability VCID-f9nm-d5ax-qkcb
4
vulnerability VCID-g7ux-4vz2-ckfg
5
vulnerability VCID-secz-78pt-dben
6
vulnerability VCID-w8ff-vxga-8qcz
7
vulnerability VCID-wgur-psum-pbck
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.19.0
aliases CVE-2026-3783
risk_score 2.5
exploitability 0.5
weighted_severity 5.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hhms-2hg6-nke9
15
url VCID-jnq1-hk6d-b3a3
vulnerability_id VCID-jnq1-hk6d-b3a3
summary When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2398.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2398.json
1
reference_url https://curl.se/docs/CVE-2024-2398.html
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://curl.se/docs/CVE-2024-2398.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2402845
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://hackerone.com/reports/2402845
4
reference_url http://seclists.org/fulldisclosure/2024/Jul/18
reference_id 18
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url http://seclists.org/fulldisclosure/2024/Jul/18
5
reference_url http://seclists.org/fulldisclosure/2024/Jul/19
reference_id 19
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url http://seclists.org/fulldisclosure/2024/Jul/19
6
reference_url http://seclists.org/fulldisclosure/2024/Jul/20
reference_id 20
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url http://seclists.org/fulldisclosure/2024/Jul/20
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2270498
reference_id 2270498
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2270498
8
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
reference_id 2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
9
reference_url http://www.openwall.com/lists/oss-security/2024/03/27/3
reference_id 3
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url http://www.openwall.com/lists/oss-security/2024/03/27/3
10
reference_url https://curl.se/docs/CVE-2024-2398.json
reference_id CVE-2024-2398.json
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://curl.se/docs/CVE-2024-2398.json
11
reference_url https://security.gentoo.org/glsa/202409-20
reference_id GLSA-202409-20
reference_type
scores
url https://security.gentoo.org/glsa/202409-20
12
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
reference_id GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
13
reference_url https://support.apple.com/kb/HT214118
reference_id HT214118
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://support.apple.com/kb/HT214118
14
reference_url https://support.apple.com/kb/HT214119
reference_id HT214119
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://support.apple.com/kb/HT214119
15
reference_url https://support.apple.com/kb/HT214120
reference_id HT214120
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://support.apple.com/kb/HT214120
16
reference_url https://security.netapp.com/advisory/ntap-20240503-0009/
reference_id ntap-20240503-0009
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-26T18:57:39Z/
url https://security.netapp.com/advisory/ntap-20240503-0009/
17
reference_url https://access.redhat.com/errata/RHSA-2024:10135
reference_id RHSA-2024:10135
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:10135
18
reference_url https://access.redhat.com/errata/RHSA-2024:11109
reference_id RHSA-2024:11109
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:11109
19
reference_url https://access.redhat.com/errata/RHSA-2024:2693
reference_id RHSA-2024:2693
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2693
20
reference_url https://access.redhat.com/errata/RHSA-2024:2694
reference_id RHSA-2024:2694
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2694
21
reference_url https://access.redhat.com/errata/RHSA-2024:3998
reference_id RHSA-2024:3998
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:3998
22
reference_url https://access.redhat.com/errata/RHSA-2024:5529
reference_id RHSA-2024:5529
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5529
23
reference_url https://access.redhat.com/errata/RHSA-2024:5654
reference_id RHSA-2024:5654
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5654
24
reference_url https://access.redhat.com/errata/RHSA-2024:7213
reference_id RHSA-2024:7213
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:7213
25
reference_url https://access.redhat.com/errata/RHSA-2024:7374
reference_id RHSA-2024:7374
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:7374
fixed_packages
0
url pkg:generic/curl.se/curl@8.7.0
purl pkg:generic/curl.se/curl@8.7.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-85ne-e7gm-5ua9
8
vulnerability VCID-bcuq-n4vb-k7f3
9
vulnerability VCID-bp56-gy66-mqae
10
vulnerability VCID-f9nm-d5ax-qkcb
11
vulnerability VCID-fcb7-8163-muf4
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-hhms-2hg6-nke9
15
vulnerability VCID-kq38-7s5x-nqaz
16
vulnerability VCID-p155-gbtu-abg1
17
vulnerability VCID-secz-78pt-dben
18
vulnerability VCID-u1p8-s8vm-3yer
19
vulnerability VCID-v82t-s9e1-2fbw
20
vulnerability VCID-w8ff-vxga-8qcz
21
vulnerability VCID-wgur-psum-pbck
22
vulnerability VCID-y41p-tgpa-m7cs
23
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.7.0
aliases CVE-2024-2398
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jnq1-hk6d-b3a3
16
url VCID-k3nv-gf9b-5ua2
vulnerability_id VCID-k3nv-gf9b-5ua2
summary When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-38039.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-38039.json
1
reference_url https://curl.se/docs/CVE-2023-38039.html
reference_id
reference_type
scores
0
value Medium
scoring_system cvssv3.1
scoring_elements
url https://curl.se/docs/CVE-2023-38039.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2072338
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://hackerone.com/reports/2072338
4
reference_url http://seclists.org/fulldisclosure/2023/Oct/17
reference_id 17
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url http://seclists.org/fulldisclosure/2023/Oct/17
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2239135
reference_id 2239135
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2239135
6
reference_url http://seclists.org/fulldisclosure/2024/Jan/34
reference_id 34
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url http://seclists.org/fulldisclosure/2024/Jan/34
7
reference_url http://seclists.org/fulldisclosure/2024/Jan/37
reference_id 37
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url http://seclists.org/fulldisclosure/2024/Jan/37
8
reference_url http://seclists.org/fulldisclosure/2024/Jan/38
reference_id 38
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url http://seclists.org/fulldisclosure/2024/Jan/38
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/
reference_id 5DCZMYODALBLVOXVJEN2LF2MLANEYL4F
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/
10
reference_url https://security.gentoo.org/glsa/202310-12
reference_id GLSA-202310-12
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://security.gentoo.org/glsa/202310-12
11
reference_url https://support.apple.com/kb/HT214036
reference_id HT214036
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://support.apple.com/kb/HT214036
12
reference_url https://support.apple.com/kb/HT214057
reference_id HT214057
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://support.apple.com/kb/HT214057
13
reference_url https://support.apple.com/kb/HT214058
reference_id HT214058
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://support.apple.com/kb/HT214058
14
reference_url https://support.apple.com/kb/HT214063
reference_id HT214063
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://support.apple.com/kb/HT214063
15
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/
reference_id M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/
16
reference_url https://security.netapp.com/advisory/ntap-20231013-0005/
reference_id ntap-20231013-0005
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://security.netapp.com/advisory/ntap-20231013-0005/
17
reference_url https://access.redhat.com/errata/RHSA-2023:7625
reference_id RHSA-2023:7625
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7625
18
reference_url https://access.redhat.com/errata/RHSA-2023:7626
reference_id RHSA-2023:7626
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7626
19
reference_url https://www.insyde.com/security-pledge/SA-2023064
reference_id SA-2023064
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://www.insyde.com/security-pledge/SA-2023064
20
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/
reference_id TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-03T19:17:43Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/
fixed_packages
0
url pkg:generic/curl.se/curl@8.3.0
purl pkg:generic/curl.se/curl@8.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-85qb-zec7-subc
8
vulnerability VCID-bcuq-n4vb-k7f3
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-ffmg-djmk-57hn
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-hhms-2hg6-nke9
15
vulnerability VCID-jnq1-hk6d-b3a3
16
vulnerability VCID-kq38-7s5x-nqaz
17
vulnerability VCID-p155-gbtu-abg1
18
vulnerability VCID-razg-yr7y-ukgd
19
vulnerability VCID-secz-78pt-dben
20
vulnerability VCID-u1p8-s8vm-3yer
21
vulnerability VCID-v82t-s9e1-2fbw
22
vulnerability VCID-w472-84ep-fkdx
23
vulnerability VCID-w8ff-vxga-8qcz
24
vulnerability VCID-wgur-psum-pbck
25
vulnerability VCID-wmam-qmmg-6uay
26
vulnerability VCID-y41p-tgpa-m7cs
27
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.3.0
aliases CVE-2023-38039
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k3nv-gf9b-5ua2
17
url VCID-kq38-7s5x-nqaz
vulnerability_id VCID-kq38-7s5x-nqaz
summary libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7264.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7264.json
1
reference_url https://curl.se/docs/CVE-2024-7264.html
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T20:05:41Z/
url https://curl.se/docs/CVE-2024-7264.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2629968
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T20:05:41Z/
url https://hackerone.com/reports/2629968
4
reference_url http://www.openwall.com/lists/oss-security/2024/07/31/1
reference_id 1
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T20:05:41Z/
url http://www.openwall.com/lists/oss-security/2024/07/31/1
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1077656
reference_id 1077656
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1077656
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2301888
reference_id 2301888
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2301888
7
reference_url https://curl.se/docs/CVE-2024-7264.json
reference_id CVE-2024-7264.json
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T20:05:41Z/
url https://curl.se/docs/CVE-2024-7264.json
8
reference_url https://access.redhat.com/errata/RHSA-2024:7726
reference_id RHSA-2024:7726
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:7726
9
reference_url https://access.redhat.com/errata/RHSA-2025:1671
reference_id RHSA-2025:1671
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:1671
10
reference_url https://access.redhat.com/errata/RHSA-2025:1673
reference_id RHSA-2025:1673
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:1673
fixed_packages
0
url pkg:generic/curl.se/curl@8.9.1
purl pkg:generic/curl.se/curl@8.9.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-bcuq-n4vb-k7f3
8
vulnerability VCID-bp56-gy66-mqae
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-g7ux-4vz2-ckfg
12
vulnerability VCID-gux4-dncg-h7a6
13
vulnerability VCID-hhms-2hg6-nke9
14
vulnerability VCID-ns6z-wp2x-fkdq
15
vulnerability VCID-p155-gbtu-abg1
16
vulnerability VCID-secz-78pt-dben
17
vulnerability VCID-t45k-skv6-cfg2
18
vulnerability VCID-u1p8-s8vm-3yer
19
vulnerability VCID-v82t-s9e1-2fbw
20
vulnerability VCID-w8ff-vxga-8qcz
21
vulnerability VCID-wgur-psum-pbck
22
vulnerability VCID-y41p-tgpa-m7cs
23
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.9.1
aliases CVE-2024-7264
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kq38-7s5x-nqaz
18
url VCID-p155-gbtu-abg1
vulnerability_id VCID-p155-gbtu-abg1
summary curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-10966.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-10966.json
1
reference_url https://curl.se/docs/CVE-2025-10966.html
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-10T20:26:03Z/
url https://curl.se/docs/CVE-2025-10966.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3355218
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-10T20:26:03Z/
url https://hackerone.com/reports/3355218
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2413308
reference_id 2413308
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2413308
5
reference_url https://curl.se/docs/CVE-2025-10966.json
reference_id CVE-2025-10966.json
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-10T20:26:03Z/
url https://curl.se/docs/CVE-2025-10966.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.17.0
purl pkg:generic/curl.se/curl@8.17.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-21ff-tazv-9ud3
1
vulnerability VCID-39qh-jayw-g3dh
2
vulnerability VCID-5un8-xymy-37bt
3
vulnerability VCID-7wqd-99h2-e7hk
4
vulnerability VCID-9vbs-w124-q3au
5
vulnerability VCID-bcuq-n4vb-k7f3
6
vulnerability VCID-f9nm-d5ax-qkcb
7
vulnerability VCID-fcb7-8163-muf4
8
vulnerability VCID-fxgf-t3ue-6qhf
9
vulnerability VCID-g7ux-4vz2-ckfg
10
vulnerability VCID-gux4-dncg-h7a6
11
vulnerability VCID-hhms-2hg6-nke9
12
vulnerability VCID-secz-78pt-dben
13
vulnerability VCID-t45k-skv6-cfg2
14
vulnerability VCID-v82t-s9e1-2fbw
15
vulnerability VCID-w8ff-vxga-8qcz
16
vulnerability VCID-wgur-psum-pbck
17
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.17.0
aliases CVE-2025-10966
risk_score 2.6
exploitability 0.5
weighted_severity 5.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p155-gbtu-abg1
19
url VCID-razg-yr7y-ukgd
vulnerability_id VCID-razg-yr7y-ukgd
summary multiple issues
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-38545.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-38545.json
1
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2
reference_url https://hackerone.com/reports/2187833
reference_id
reference_type
scores
url https://hackerone.com/reports/2187833
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2241933
reference_id 2241933
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2241933
4
reference_url http://seclists.org/fulldisclosure/2024/Jan/34
reference_id 34
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url http://seclists.org/fulldisclosure/2024/Jan/34
5
reference_url http://seclists.org/fulldisclosure/2024/Jan/37
reference_id 37
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url http://seclists.org/fulldisclosure/2024/Jan/37
6
reference_url http://seclists.org/fulldisclosure/2024/Jan/38
reference_id 38
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url http://seclists.org/fulldisclosure/2024/Jan/38
7
reference_url https://security.archlinux.org/AVG-2845
reference_id AVG-2845
reference_type
scores
0
value High
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-2845
8
reference_url https://security.archlinux.org/AVG-2846
reference_id AVG-2846
reference_type
scores
0
value High
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-2846
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38545
reference_id CVE-2023-38545
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-38545
10
reference_url https://curl.se/docs/CVE-2023-38545.html
reference_id CVE-2023-38545.HTML
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value High
scoring_system cvssv3.1
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://curl.se/docs/CVE-2023-38545.html
11
reference_url https://security.gentoo.org/glsa/202310-12
reference_id GLSA-202310-12
reference_type
scores
url https://security.gentoo.org/glsa/202310-12
12
reference_url https://www.secpod.com/blog/high-severity-heap-buffer-overflow-vulnerability/
reference_id high-severity-heap-buffer-overflow-vulnerability
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://www.secpod.com/blog/high-severity-heap-buffer-overflow-vulnerability/
13
reference_url https://support.apple.com/kb/HT214036
reference_id HT214036
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://support.apple.com/kb/HT214036
14
reference_url https://support.apple.com/kb/HT214057
reference_id HT214057
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://support.apple.com/kb/HT214057
15
reference_url https://support.apple.com/kb/HT214058
reference_id HT214058
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://support.apple.com/kb/HT214058
16
reference_url https://support.apple.com/kb/HT214063
reference_id HT214063
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://support.apple.com/kb/HT214063
17
reference_url https://security.netapp.com/advisory/ntap-20231027-0009/
reference_id ntap-20231027-0009
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://security.netapp.com/advisory/ntap-20231027-0009/
18
reference_url https://security.netapp.com/advisory/ntap-20240201-0005/
reference_id ntap-20240201-0005
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://security.netapp.com/advisory/ntap-20240201-0005/
19
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/
reference_id OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/
20
reference_url https://access.redhat.com/errata/RHSA-2023:5700
reference_id RHSA-2023:5700
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:5700
21
reference_url https://access.redhat.com/errata/RHSA-2023:5763
reference_id RHSA-2023:5763
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:5763
22
reference_url https://access.redhat.com/errata/RHSA-2023:6745
reference_id RHSA-2023:6745
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:6745
23
reference_url https://access.redhat.com/errata/RHSA-2023:7625
reference_id RHSA-2023:7625
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7625
24
reference_url https://access.redhat.com/errata/RHSA-2023:7626
reference_id RHSA-2023:7626
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7626
25
reference_url https://access.redhat.com/errata/RHSA-2024:0797
reference_id RHSA-2024:0797
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0797
26
reference_url https://access.redhat.com/errata/RHSA-2024:2011
reference_id RHSA-2024:2011
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2011
27
reference_url https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868
reference_id viewtopic.php?f=8&t=8868
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-17T21:11:03Z/
url https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868
fixed_packages
0
url pkg:generic/curl.se/curl@8.4.0
purl pkg:generic/curl.se/curl@8.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-85qb-zec7-subc
8
vulnerability VCID-bcuq-n4vb-k7f3
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-ffmg-djmk-57hn
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-hhms-2hg6-nke9
15
vulnerability VCID-jnq1-hk6d-b3a3
16
vulnerability VCID-kq38-7s5x-nqaz
17
vulnerability VCID-p155-gbtu-abg1
18
vulnerability VCID-secz-78pt-dben
19
vulnerability VCID-u1p8-s8vm-3yer
20
vulnerability VCID-v82t-s9e1-2fbw
21
vulnerability VCID-w8ff-vxga-8qcz
22
vulnerability VCID-wgur-psum-pbck
23
vulnerability VCID-wmam-qmmg-6uay
24
vulnerability VCID-y41p-tgpa-m7cs
25
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.4.0
aliases CVE-2023-38545
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-razg-yr7y-ukgd
20
url VCID-secz-78pt-dben
vulnerability_id VCID-secz-78pt-dben
summary curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6253.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6253.json
1
reference_url https://curl.se/docs/CVE-2026-6253.html
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:42:30Z/
url https://curl.se/docs/CVE-2026-6253.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3669637
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:42:30Z/
url https://hackerone.com/reports/3669637
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461202
reference_id 2461202
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461202
5
reference_url https://curl.se/docs/CVE-2026-6253.json
reference_id CVE-2026-6253.json
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:42:30Z/
url https://curl.se/docs/CVE-2026-6253.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:12916
reference_id RHSA-2026:12916
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:12916
fixed_packages
0
url pkg:generic/curl.se/curl@8.20.0
purl pkg:generic/curl.se/curl@8.20.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.20.0
aliases CVE-2026-6253
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-secz-78pt-dben
21
url VCID-u1p8-s8vm-3yer
vulnerability_id VCID-u1p8-s8vm-3yer
summary When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-11053.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-11053.json
1
reference_url https://curl.se/docs/CVE-2024-11053.html
reference_id
reference_type
scores
0
value 3.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-15T16:47:42Z/
url https://curl.se/docs/CVE-2024-11053.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2829063
reference_id
reference_type
scores
0
value 3.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-15T16:47:42Z/
url https://hackerone.com/reports/2829063
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089682
reference_id 1089682
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089682
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2331191
reference_id 2331191
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2331191
6
reference_url https://curl.se/docs/CVE-2024-11053.json
reference_id CVE-2024-11053.json
reference_type
scores
0
value 3.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-15T16:47:42Z/
url https://curl.se/docs/CVE-2024-11053.json
7
reference_url https://access.redhat.com/errata/RHSA-2025:1671
reference_id RHSA-2025:1671
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:1671
8
reference_url https://access.redhat.com/errata/RHSA-2025:1673
reference_id RHSA-2025:1673
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:1673
fixed_packages
0
url pkg:generic/curl.se/curl@8.11.1
purl pkg:generic/curl.se/curl@8.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-7wqd-99h2-e7hk
6
vulnerability VCID-bcuq-n4vb-k7f3
7
vulnerability VCID-bp56-gy66-mqae
8
vulnerability VCID-ejn1-w8wj-1qau
9
vulnerability VCID-ezve-gc2h-qyga
10
vulnerability VCID-f9nm-d5ax-qkcb
11
vulnerability VCID-fcb7-8163-muf4
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-hhms-2hg6-nke9
15
vulnerability VCID-ns6z-wp2x-fkdq
16
vulnerability VCID-p155-gbtu-abg1
17
vulnerability VCID-secz-78pt-dben
18
vulnerability VCID-t45k-skv6-cfg2
19
vulnerability VCID-v82t-s9e1-2fbw
20
vulnerability VCID-w8ff-vxga-8qcz
21
vulnerability VCID-wgur-psum-pbck
22
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.11.1
aliases CVE-2024-11053
risk_score 2.6
exploitability 0.5
weighted_severity 5.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u1p8-s8vm-3yer
22
url VCID-v82t-s9e1-2fbw
vulnerability_id VCID-v82t-s9e1-2fbw
summary When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-15079.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-15079.json
1
reference_url https://curl.se/docs/CVE-2025-15079.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:45:34Z/
url https://curl.se/docs/CVE-2025-15079.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3477116
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:45:34Z/
url https://hackerone.com/reports/3477116
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2426409
reference_id 2426409
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2426409
5
reference_url https://curl.se/docs/CVE-2025-15079.json
reference_id CVE-2025-15079.json
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:45:34Z/
url https://curl.se/docs/CVE-2025-15079.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.18.0
purl pkg:generic/curl.se/curl@8.18.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-39qh-jayw-g3dh
1
vulnerability VCID-5un8-xymy-37bt
2
vulnerability VCID-9vbs-w124-q3au
3
vulnerability VCID-bcuq-n4vb-k7f3
4
vulnerability VCID-f9nm-d5ax-qkcb
5
vulnerability VCID-fxgf-t3ue-6qhf
6
vulnerability VCID-g7ux-4vz2-ckfg
7
vulnerability VCID-hhms-2hg6-nke9
8
vulnerability VCID-secz-78pt-dben
9
vulnerability VCID-w8ff-vxga-8qcz
10
vulnerability VCID-wgur-psum-pbck
11
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.18.0
aliases CVE-2025-15079
risk_score 3.6
exploitability 0.5
weighted_severity 7.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v82t-s9e1-2fbw
23
url VCID-w472-84ep-fkdx
vulnerability_id VCID-w472-84ep-fkdx
summary multiple issues
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-38546.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-38546.json
1
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2
reference_url https://hackerone.com/reports/2148242
reference_id
reference_type
scores
url https://hackerone.com/reports/2148242
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2241938
reference_id 2241938
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2241938
4
reference_url http://seclists.org/fulldisclosure/2024/Jan/34
reference_id 34
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url http://seclists.org/fulldisclosure/2024/Jan/34
5
reference_url http://seclists.org/fulldisclosure/2024/Jan/37
reference_id 37
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url http://seclists.org/fulldisclosure/2024/Jan/37
6
reference_url http://seclists.org/fulldisclosure/2024/Jan/38
reference_id 38
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url http://seclists.org/fulldisclosure/2024/Jan/38
7
reference_url https://security.archlinux.org/AVG-2845
reference_id AVG-2845
reference_type
scores
0
value High
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-2845
8
reference_url https://security.archlinux.org/AVG-2846
reference_id AVG-2846
reference_type
scores
0
value High
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-2846
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38546
reference_id CVE-2023-38546
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-38546
10
reference_url https://curl.se/docs/CVE-2023-38546.html
reference_id CVE-2023-38546.HTML
reference_type
scores
0
value Low
scoring_system cvssv3.1
scoring_elements
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url https://curl.se/docs/CVE-2023-38546.html
11
reference_url https://security.gentoo.org/glsa/202310-12
reference_id GLSA-202310-12
reference_type
scores
url https://security.gentoo.org/glsa/202310-12
12
reference_url https://support.apple.com/kb/HT214036
reference_id HT214036
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url https://support.apple.com/kb/HT214036
13
reference_url https://support.apple.com/kb/HT214057
reference_id HT214057
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url https://support.apple.com/kb/HT214057
14
reference_url https://support.apple.com/kb/HT214058
reference_id HT214058
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url https://support.apple.com/kb/HT214058
15
reference_url https://support.apple.com/kb/HT214063
reference_id HT214063
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url https://support.apple.com/kb/HT214063
16
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/
reference_id OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/
17
reference_url https://access.redhat.com/errata/RHSA-2023:5700
reference_id RHSA-2023:5700
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:5700
18
reference_url https://access.redhat.com/errata/RHSA-2023:5763
reference_id RHSA-2023:5763
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:5763
19
reference_url https://access.redhat.com/errata/RHSA-2023:6292
reference_id RHSA-2023:6292
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:6292
20
reference_url https://access.redhat.com/errata/RHSA-2023:6745
reference_id RHSA-2023:6745
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:6745
21
reference_url https://access.redhat.com/errata/RHSA-2023:7540
reference_id RHSA-2023:7540
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7540
22
reference_url https://access.redhat.com/errata/RHSA-2023:7625
reference_id RHSA-2023:7625
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7625
23
reference_url https://access.redhat.com/errata/RHSA-2023:7626
reference_id RHSA-2023:7626
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7626
24
reference_url https://access.redhat.com/errata/RHSA-2024:1601
reference_id RHSA-2024:1601
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1601
25
reference_url https://access.redhat.com/errata/RHSA-2024:2092
reference_id RHSA-2024:2092
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2092
26
reference_url https://access.redhat.com/errata/RHSA-2024:2093
reference_id RHSA-2024:2093
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2093
27
reference_url https://access.redhat.com/errata/RHSA-2024:2101
reference_id RHSA-2024:2101
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2101
28
reference_url https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868
reference_id viewtopic.php?f=8&t=8868
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-13T15:01:53Z/
url https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868
fixed_packages
0
url pkg:generic/curl.se/curl@8.4.0
purl pkg:generic/curl.se/curl@8.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-85qb-zec7-subc
8
vulnerability VCID-bcuq-n4vb-k7f3
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-ffmg-djmk-57hn
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-hhms-2hg6-nke9
15
vulnerability VCID-jnq1-hk6d-b3a3
16
vulnerability VCID-kq38-7s5x-nqaz
17
vulnerability VCID-p155-gbtu-abg1
18
vulnerability VCID-secz-78pt-dben
19
vulnerability VCID-u1p8-s8vm-3yer
20
vulnerability VCID-v82t-s9e1-2fbw
21
vulnerability VCID-w8ff-vxga-8qcz
22
vulnerability VCID-wgur-psum-pbck
23
vulnerability VCID-wmam-qmmg-6uay
24
vulnerability VCID-y41p-tgpa-m7cs
25
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.4.0
aliases CVE-2023-38546
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w472-84ep-fkdx
24
url VCID-w8ff-vxga-8qcz
vulnerability_id VCID-w8ff-vxga-8qcz
summary curl: curl: Information disclosure due to incorrect TLS connection reuse
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4873.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4873.json
1
reference_url https://curl.se/docs/CVE-2026-4873.html
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T19:29:14Z/
url https://curl.se/docs/CVE-2026-4873.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3621851
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T19:29:14Z/
url https://hackerone.com/reports/3621851
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461200
reference_id 2461200
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461200
5
reference_url https://curl.se/docs/CVE-2026-4873.json
reference_id CVE-2026-4873.json
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T19:29:14Z/
url https://curl.se/docs/CVE-2026-4873.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:12916
reference_id RHSA-2026:12916
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:12916
fixed_packages
0
url pkg:generic/curl.se/curl@8.20.0
purl pkg:generic/curl.se/curl@8.20.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.20.0
aliases CVE-2026-4873
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w8ff-vxga-8qcz
25
url VCID-wgur-psum-pbck
vulnerability_id VCID-wgur-psum-pbck
summary curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6276.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6276.json
1
reference_url https://curl.se/docs/CVE-2026-6276.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:24:29Z/
url https://curl.se/docs/CVE-2026-6276.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3671818
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:24:29Z/
url https://hackerone.com/reports/3671818
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461203
reference_id 2461203
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461203
5
reference_url https://curl.se/docs/CVE-2026-6276.json
reference_id CVE-2026-6276.json
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:24:29Z/
url https://curl.se/docs/CVE-2026-6276.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:12916
reference_id RHSA-2026:12916
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:12916
fixed_packages
0
url pkg:generic/curl.se/curl@8.20.0
purl pkg:generic/curl.se/curl@8.20.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.20.0
aliases CVE-2026-6276
risk_score 1.6
exploitability 0.5
weighted_severity 3.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wgur-psum-pbck
26
url VCID-wmam-qmmg-6uay
vulnerability_id VCID-wmam-qmmg-6uay
summary This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-46218.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-46218.json
1
reference_url https://curl.se/docs/CVE-2023-46218.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-28T16:38:08Z/
url https://curl.se/docs/CVE-2023-46218.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2212193
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-28T16:38:08Z/
url https://hackerone.com/reports/2212193
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057646
reference_id 1057646
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057646
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2252030
reference_id 2252030
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2252030
6
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
reference_id 3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-28T16:38:08Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
7
reference_url https://www.debian.org/security/2023/dsa-5587
reference_id dsa-5587
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-28T16:38:08Z/
url https://www.debian.org/security/2023/dsa-5587
8
reference_url https://security.gentoo.org/glsa/202409-20
reference_id GLSA-202409-20
reference_type
scores
url https://security.gentoo.org/glsa/202409-20
9
reference_url https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
reference_id msg00015.html
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-28T16:38:08Z/
url https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
10
reference_url https://security.netapp.com/advisory/ntap-20240125-0007/
reference_id ntap-20240125-0007
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-28T16:38:08Z/
url https://security.netapp.com/advisory/ntap-20240125-0007/
11
reference_url https://access.redhat.com/errata/RHSA-2024:0428
reference_id RHSA-2024:0428
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0428
12
reference_url https://access.redhat.com/errata/RHSA-2024:0434
reference_id RHSA-2024:0434
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0434
13
reference_url https://access.redhat.com/errata/RHSA-2024:0452
reference_id RHSA-2024:0452
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0452
14
reference_url https://access.redhat.com/errata/RHSA-2024:0585
reference_id RHSA-2024:0585
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0585
15
reference_url https://access.redhat.com/errata/RHSA-2024:1129
reference_id RHSA-2024:1129
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1129
16
reference_url https://access.redhat.com/errata/RHSA-2024:1316
reference_id RHSA-2024:1316
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1316
17
reference_url https://access.redhat.com/errata/RHSA-2024:1317
reference_id RHSA-2024:1317
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1317
18
reference_url https://access.redhat.com/errata/RHSA-2024:1383
reference_id RHSA-2024:1383
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1383
19
reference_url https://access.redhat.com/errata/RHSA-2024:1601
reference_id RHSA-2024:1601
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1601
20
reference_url https://access.redhat.com/errata/RHSA-2024:2092
reference_id RHSA-2024:2092
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2092
21
reference_url https://access.redhat.com/errata/RHSA-2024:2093
reference_id RHSA-2024:2093
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2093
22
reference_url https://access.redhat.com/errata/RHSA-2024:2094
reference_id RHSA-2024:2094
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2094
23
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
reference_id UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-28T16:38:08Z/
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
fixed_packages
0
url pkg:generic/curl.se/curl@8.5.0
purl pkg:generic/curl.se/curl@8.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-bcuq-n4vb-k7f3
8
vulnerability VCID-bp56-gy66-mqae
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-ffmg-djmk-57hn
12
vulnerability VCID-g7ux-4vz2-ckfg
13
vulnerability VCID-gux4-dncg-h7a6
14
vulnerability VCID-h7v8-bg58-mkhu
15
vulnerability VCID-hhms-2hg6-nke9
16
vulnerability VCID-jnq1-hk6d-b3a3
17
vulnerability VCID-ke97-b9rb-5bfd
18
vulnerability VCID-kq38-7s5x-nqaz
19
vulnerability VCID-p155-gbtu-abg1
20
vulnerability VCID-secz-78pt-dben
21
vulnerability VCID-u1p8-s8vm-3yer
22
vulnerability VCID-v82t-s9e1-2fbw
23
vulnerability VCID-w8ff-vxga-8qcz
24
vulnerability VCID-wgur-psum-pbck
25
vulnerability VCID-y41p-tgpa-m7cs
26
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.5.0
aliases CVE-2023-46218
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wmam-qmmg-6uay
27
url VCID-y41p-tgpa-m7cs
vulnerability_id VCID-y41p-tgpa-m7cs
summary When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8096.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8096.json
1
reference_url https://curl.se/docs/CVE-2024-8096.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Medium
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-11T13:42:47Z/
url https://curl.se/docs/CVE-2024-8096.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/2669852
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-11T13:42:47Z/
url https://hackerone.com/reports/2669852
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2310519
reference_id 2310519
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2310519
5
reference_url https://curl.se/docs/CVE-2024-8096.json
reference_id CVE-2024-8096.json
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-11T13:42:47Z/
url https://curl.se/docs/CVE-2024-8096.json
fixed_packages
0
url pkg:generic/curl.se/curl@8.10.0
purl pkg:generic/curl.se/curl@8.10.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1dw3-33ju-jkbs
1
vulnerability VCID-21ff-tazv-9ud3
2
vulnerability VCID-39qh-jayw-g3dh
3
vulnerability VCID-3p2z-61gq-muhs
4
vulnerability VCID-5un8-xymy-37bt
5
vulnerability VCID-6ggz-pa5t-77c4
6
vulnerability VCID-7wqd-99h2-e7hk
7
vulnerability VCID-bcuq-n4vb-k7f3
8
vulnerability VCID-bp56-gy66-mqae
9
vulnerability VCID-f9nm-d5ax-qkcb
10
vulnerability VCID-fcb7-8163-muf4
11
vulnerability VCID-g7ux-4vz2-ckfg
12
vulnerability VCID-gux4-dncg-h7a6
13
vulnerability VCID-hhms-2hg6-nke9
14
vulnerability VCID-ns6z-wp2x-fkdq
15
vulnerability VCID-p155-gbtu-abg1
16
vulnerability VCID-secz-78pt-dben
17
vulnerability VCID-t45k-skv6-cfg2
18
vulnerability VCID-u1p8-s8vm-3yer
19
vulnerability VCID-v82t-s9e1-2fbw
20
vulnerability VCID-w8ff-vxga-8qcz
21
vulnerability VCID-wgur-psum-pbck
22
vulnerability VCID-y44u-23he-aya8
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.10.0
aliases CVE-2024-8096
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y41p-tgpa-m7cs
28
url VCID-y44u-23he-aya8
vulnerability_id VCID-y44u-23he-aya8
summary curl: curl: Unauthorized access due to improper HTTP proxy connection reuse
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-3784.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-3784.json
1
reference_url https://curl.se/docs/CVE-2026-3784.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Low
scoring_system cvssv3.1
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-11T15:48:38Z/
url https://curl.se/docs/CVE-2026-3784.html
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://hackerone.com/reports/3584903
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-11T15:48:38Z/
url https://hackerone.com/reports/3584903
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2446449
reference_id 2446449
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2446449
5
reference_url https://curl.se/docs/CVE-2026-3784.json
reference_id CVE-2026-3784.json
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-11T15:48:38Z/
url https://curl.se/docs/CVE-2026-3784.json
6
reference_url https://access.redhat.com/errata/RHSA-2026:6893
reference_id RHSA-2026:6893
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6893
fixed_packages
0
url pkg:generic/curl.se/curl@8.19.0
purl pkg:generic/curl.se/curl@8.19.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5un8-xymy-37bt
1
vulnerability VCID-9vbs-w124-q3au
2
vulnerability VCID-bcuq-n4vb-k7f3
3
vulnerability VCID-f9nm-d5ax-qkcb
4
vulnerability VCID-g7ux-4vz2-ckfg
5
vulnerability VCID-secz-78pt-dben
6
vulnerability VCID-w8ff-vxga-8qcz
7
vulnerability VCID-wgur-psum-pbck
resource_url http://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.19.0
aliases CVE-2026-3784
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y44u-23he-aya8
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:generic/curl.se/curl@8.2.0