Version prüfen
curl --versionCVEs, die 7.28 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2016-8619 | The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. | 9.8 | — | 2018-08-01 | |
| CVE-2016-8618 | The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-fre... | 9.8 | — | 2018-07-31 | |
| CVE-2019-5482 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | 9.8 | — | 2019-09-16 | |
| CVE-2022-32221 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask... | 9.8 | — | 2022-12-05 | |
| CVE-2016-8620 | The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-boun... | 9.8 | — | 2018-08-01 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | 9.8 | — | 2026-07-03 | |
| CVE-2018-1000007 | libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send cu... | 9.8 | — | 2018-01-24 | |
| CVE-2018-1000120 | A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an at... | 9.8 | — | 2018-03-14 | |
| CVE-2017-8817 | The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of servi... | 9.8 | — | 2017-11-29 | |
| CVE-2016-4606 | Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execut... | 9.8 | — | 2020-02-21 | |
| CVE-2018-1000122 | A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allow... | 9.1 | — | 2018-03-14 | |
| CVE-2018-16842 | Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf()... | 9.1 | — | 2018-10-31 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | 9.1 | — | 2026-07-03 | |
| CVE-2018-1000301 | curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in de... | 9.1 | — | 2018-05-24 | |
| CVE-2023-27533 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may all... | 8.8 | — | 2023-03-30 | |
| CVE-2023-27534 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be... | 8.8 | — | 2023-03-30 | |
| CVE-2016-9586 | curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libc... | 8.1 | — | 2018-04-23 | |
| CVE-2016-9594 | curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that return... | 8.1 | — | 2018-04-23 | |
| CVE-2016-4802 | Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or teln... | 7.8 | — | 2016-06-24 | |
| CVE-2020-8177 | curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that c... | 7.8 | — | 2020-12-14 | |
| CVE-2019-5443 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/l... | 7.8 | — | 2019-07-02 | |
| CVE-2022-27782 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that... | 7.5 | — | 2022-06-02 | |
| CVE-2021-22946 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP,... | 7.5 | — | 2021-09-29 | |
| CVE-2016-8621 | The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receive... | 7.5 | — | 2018-07-31 | |
| CVE-2016-8624 | curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part... | 7.5 | — | 2018-07-31 | |
| CVE-2016-8625 | curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may... | 7.5 | — | 2018-08-01 | |
| CVE-2018-1000121 | A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an... | 7.5 | — | 2018-03-14 | |
| CVE-2022-27781 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a... | 7.5 | — | 2022-06-02 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | 7.5 | — | 2026-07-03 | |
| CVE-2016-8615 | A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later... | 7.5 | — | 2018-08-01 | |
| CVE-2023-28319 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser... | 7.5 | — | 2023-05-26 | |
| CVE-2016-8623 | A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger... | 7.5 | — | 2018-08-01 | |
| CVE-2013-0249 | Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and... | 7.5 | — | 2013-03-08 | |
| CVE-2016-0755 | The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticate... | 7.3 | — | 2016-01-29 | |
| CVE-2025-0725 | gzip integer overflow | 7.3 | — | 2025-02-05 | |
| CVE-2016-8617 | The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit s... | 7.0 | — | 2018-07-31 | |
| CVE-2013-2174 | Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through... | 6.8 | — | 2013-07-31 | |
| CVE-2022-27776 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cook... | 6.5 | — | 2022-06-02 | |
| CVE-2017-2629 | curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh pro... | 6.5 | — | 2018-07-27 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | 6.5 | — | 2026-03-11 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | 6.5 | — | 2026-05-13 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | 6.5 | — | 2026-03-11 | |
| CVE-2021-22922 | When curl is instructed to download content using the metalink feature, thecontents is verified against a hash... | 6.5 | — | 2021-08-05 | |
| CVE-2022-32206 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed... | 6.5 | — | 2022-07-07 | |
| CVE-2014-0138 | The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) PO... | 6.4 | — | 2014-04-15 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | 6.3 | — | 2026-01-08 | |
| CVE-2023-28321 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil... | 5.9 | — | 2023-05-26 | |
| CVE-2022-43552 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols i... | 5.9 | — | 2023-02-09 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | 5.9 | — | 2026-05-13 | |
| CVE-2022-32208 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This... | 5.9 | — | 2022-07-07 | |
| CVE-2021-22947 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrad... | 5.9 | — | 2021-09-29 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | 5.9 | — | 2026-05-13 | |
| CVE-2023-28320 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend... | 5.9 | — | 2023-05-26 | |
| CVE-2016-8616 | A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive com... | 5.9 | — | 2018-08-01 | |
| CVE-2014-0139 | cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recogniz... | 5.8 | — | 2014-04-15 | |
| CVE-2022-27774 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affect... | 5.7 | — | 2022-06-02 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | 5.3 | — | 2026-05-13 | |
| CVE-2017-9502 | In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows... | 5.3 | — | 2017-06-14 | |
| CVE-2021-22925 | curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used optio... | 5.3 | — | 2021-08-05 | |
| CVE-2016-0754 | cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on... | 5.3 | — | 2016-01-29 | |
| CVE-2016-3739 | The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/... | 5.3 | — | 2016-05-20 | |
| CVE-2021-22923 | When curl is instructed to get content using the metalink feature, and a user name and password are used to do... | 5.3 | — | 2021-08-05 | |
| CVE-2014-3613 | cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remo... | 5.0 | — | 2014-11-18 | |
| CVE-2014-3620 | cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arb... | 5.0 | — | 2014-11-18 | |
| CVE-2013-1944 | The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain w... | 5.0 | — | 2013-04-29 | |
| CVE-2015-3148 | cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allow... | 5.0 | — | 2015-04-24 | |
| CVE-2015-3153 | The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and d... | 5.0 | — | 2015-05-01 | |
| CVE-2015-3143 | cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attacker... | 5.0 | — | 2015-04-24 | |
| CVE-2013-4545 | cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name fiel... | 4.3 | — | 2013-11-23 | |
| CVE-2014-0015 | cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM conn... | 4.0 | — | 2014-02-02 | |
| CVE-2014-2522 | curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, doe... | 4.0 | — | 2014-04-18 | |
| CVE-2020-8284 | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a gi... | 3.7 | — | 2020-12-14 | |
| CVE-2023-28322 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err... | 3.7 | — | 2023-05-26 | |
| CVE-2022-35252 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes t... | 3.7 | — | 2022-09-23 | |
| CVE-2021-22898 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CU... | 3.1 | — | 2021-06-11 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).