Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-n51k-39uk-auca
Vulnerability ID VCID-n51k-39uk-auca
Aliases CVE-2020-8286
Summary Multiple vulnerabilities have been found in cURL, the worst of which could result in information disclosure or data loss.
Status Published
Exploitability 0.5
Weighted Severity 6.7
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-295 Improper Certificate Validation
CWE-299 Improper Check for Certificate Revocation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8286.json
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00384 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00384 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00384 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00384 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00384 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00384 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
epss 0.00384 https://api.first.org/data/v1/epss?cve=CVE-2020-8286
ssvc Track https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
ssvc Track https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
cvssv3.1 Medium https://curl.se/docs/CVE-2020-8286.html
ssvc Track https://curl.se/docs/CVE-2020-8286.html
ssvc Track http://seclists.org/fulldisclosure/2021/Apr/50
ssvc Track http://seclists.org/fulldisclosure/2021/Apr/51
ssvc Track http://seclists.org/fulldisclosure/2021/Apr/54
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
ssvc Track https://hackerone.com/reports/1048457
ssvc Track https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
archlinux Medium https://security.archlinux.org/AVG-1337
ssvc Track https://security.gentoo.org/glsa/202012-14
ssvc Track https://security.netapp.com/advisory/ntap-20210122-0007/
ssvc Track https://support.apple.com/kb/HT212325
ssvc Track https://support.apple.com/kb/HT212326
ssvc Track https://support.apple.com/kb/HT212327
ssvc Track https://www.debian.org/security/2021/dsa-4881
ssvc Track https://www.oracle.com/security-alerts/cpuApr2021.html
ssvc Track https://www.oracle.com/security-alerts/cpuapr2022.html
ssvc Track https://www.oracle.com//security-alerts/cpujul2021.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8286.json
https://api.first.org/data/v1/epss?cve=CVE-2020-8286
https://curl.se/docs/CVE-2020-8286.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8169
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22876
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22890
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://hackerone.com/reports/1048457
1906096 https://bugzilla.redhat.com/show_bug.cgi?id=1906096
50 http://seclists.org/fulldisclosure/2021/Apr/50
51 http://seclists.org/fulldisclosure/2021/Apr/51
54 http://seclists.org/fulldisclosure/2021/Apr/54
977161 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=977161
AVG-1337 https://security.archlinux.org/AVG-1337
CVE-2020-8286 https://nvd.nist.gov/vuln/detail/CVE-2020-8286
DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
dsa-4881 https://www.debian.org/security/2021/dsa-4881
GLSA-202012-14 https://security.gentoo.org/glsa/202012-14
HT212325 https://support.apple.com/kb/HT212325
HT212326 https://support.apple.com/kb/HT212326
HT212327 https://support.apple.com/kb/HT212327
msg00029.html https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
ntap-20210122-0007 https://security.netapp.com/advisory/ntap-20210122-0007/
NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
RHSA-2021:1610 https://access.redhat.com/errata/RHSA-2021:1610
RHSA-2021:2471 https://access.redhat.com/errata/RHSA-2021:2471
RHSA-2021:2472 https://access.redhat.com/errata/RHSA-2021:2472
ssa-200951.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
USN-4665-1 https://usn.ubuntu.com/4665-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8286.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://curl.se/docs/CVE-2020-8286.html
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at http://seclists.org/fulldisclosure/2021/Apr/50
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at http://seclists.org/fulldisclosure/2021/Apr/51
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at http://seclists.org/fulldisclosure/2021/Apr/54
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://hackerone.com/reports/1048457
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://security.gentoo.org/glsa/202012-14
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://security.netapp.com/advisory/ntap-20210122-0007/
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://support.apple.com/kb/HT212325
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://support.apple.com/kb/HT212326
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://support.apple.com/kb/HT212327
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://www.debian.org/security/2021/dsa-4881
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://www.oracle.com/security-alerts/cpuApr2021.html
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://www.oracle.com/security-alerts/cpuapr2022.html
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T15:29:39Z/ Found at https://www.oracle.com//security-alerts/cpujul2021.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.52128
EPSS Score 0.00286
Published At April 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:03:38.720341+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202012-14 38.0.0