VulnerableCode Package Details - pkg:conan/libcurl@7.88.1

Search for packages

Vulnerability	Summary	Fixed by
VCID-cbah-e86c-w3fj Aliases: CVE-2023-27535	Improper Authentication An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.	8.0.1 Affected by 0 other vulnerabilities.
VCID-ke81-x2ze-rbc5 Aliases: CVE-2023-27537	Double Free A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.	8.0.1 Affected by 0 other vulnerabilities.
VCID-ms2r-94ph-yyh3 Aliases: CVE-2023-27536	Improper Authentication An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.	8.0.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-cbah-e86c-w3fj
Aliases:
CVE-2023-27535

Improper Authentication An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

8.0.1
Affected by 0 other vulnerabilities.

VCID-ke81-x2ze-rbc5
Aliases:
CVE-2023-27537

Double Free A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

8.0.1
Affected by 0 other vulnerabilities.

VCID-ms2r-94ph-yyh3
Aliases:
CVE-2023-27536

Improper Authentication An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

8.0.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:51:05.123346+00:00	GitLab Importer	Affected by	VCID-cbah-e86c-w3fj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/conan/libcurl/CVE-2023-27535.yml	38.0.0
2026-04-01T12:51:05.005757+00:00	GitLab Importer	Affected by	VCID-ms2r-94ph-yyh3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/conan/libcurl/CVE-2023-27536.yml	38.0.0
2026-04-01T12:51:04.983850+00:00	GitLab Importer	Affected by	VCID-ke81-x2ze-rbc5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/conan/libcurl/CVE-2023-27537.yml	38.0.0