Version prüfen
curl --versionCVEs, die 7.46 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2017-8816 | The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to caus... | 9.8 | — | 2017-11-29 | |
| CVE-2018-16839 | Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that ma... | 9.8 | — | 2018-10-31 | |
| CVE-2016-9953 | The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Window... | 9.8 | — | 2018-03-12 | |
| CVE-2016-8619 | The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. | 9.8 | — | 2018-08-01 | |
| CVE-2016-8618 | The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-fre... | 9.8 | — | 2018-07-31 | |
| CVE-2019-5482 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | 9.8 | — | 2019-09-16 | |
| CVE-2022-32221 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask... | 9.8 | — | 2022-12-05 | |
| CVE-2016-8620 | The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-boun... | 9.8 | — | 2018-08-01 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | 9.8 | — | 2026-07-03 | |
| CVE-2018-1000007 | libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send cu... | 9.8 | — | 2018-01-24 | |
| CVE-2018-1000120 | A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an at... | 9.8 | — | 2018-03-14 | |
| CVE-2017-8817 | The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of servi... | 9.8 | — | 2017-11-29 | |
| CVE-2016-4606 | Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execut... | 9.8 | — | 2020-02-21 | |
| CVE-2018-1000122 | A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allow... | 9.1 | — | 2018-03-14 | |
| CVE-2026-18924 | HTTP/2 server push UAF | 9.1 | — | 2026-09-06 | |
| CVE-2018-16842 | Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf()... | 9.1 | — | 2018-10-31 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | 9.1 | — | 2026-07-03 | |
| CVE-2026-8924 | trailing dot domain super cookie | 9.1 | — | 2026-07-03 | |
| CVE-2018-1000301 | curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in de... | 9.1 | — | 2018-05-24 | |
| CVE-2023-27533 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may all... | 8.8 | — | 2023-03-30 | |
| CVE-2023-27534 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be... | 8.8 | — | 2023-03-30 | |
| CVE-2024-2398 | HTTP/2 push headers memory-leak | 8.6 | — | 2024-03-27 | |
| CVE-2026-82209 | domain-scoped PSL domain cookie | 8.2 | — | 2026-09-06 | |
| CVE-2016-9952 | The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Window... | 8.1 | — | 2018-03-12 | |
| CVE-2016-9586 | curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libc... | 8.1 | — | 2018-04-23 | |
| CVE-2016-9594 | curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that return... | 8.1 | — | 2018-04-23 | |
| CVE-2022-22576 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse... | 8.1 | — | 2022-05-26 | |
| CVE-2026-8286 | wrong STARTTLS connection reuse | 8.1 | — | 2026-07-03 | |
| CVE-2016-4802 | Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or teln... | 7.8 | — | 2016-06-24 | |
| CVE-2020-8177 | curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that c... | 7.8 | — | 2020-12-14 | |
| CVE-2019-5443 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/l... | 7.8 | — | 2019-07-02 | |
| CVE-2022-27782 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that... | 7.5 | — | 2022-06-02 | |
| CVE-2021-22946 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP,... | 7.5 | — | 2021-09-29 | |
| CVE-2016-8621 | The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receive... | 7.5 | — | 2018-07-31 | |
| CVE-2016-8624 | curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part... | 7.5 | — | 2018-07-31 | |
| CVE-2026-80230 | OpenSSL pinning bypass | 7.5 | — | 2026-09-06 | |
| CVE-2016-8625 | curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may... | 7.5 | — | 2018-08-01 | |
| CVE-2018-1000121 | A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an... | 7.5 | — | 2018-03-14 | |
| CVE-2021-22926 | libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done wi... | 7.5 | — | 2021-08-05 | |
| CVE-2026-5773 | wrong reuse of SMB connection | 7.5 | — | 2026-05-13 | |
| CVE-2022-27781 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a... | 7.5 | — | 2022-06-02 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | 7.5 | — | 2026-07-03 | |
| CVE-2016-8615 | A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later... | 7.5 | — | 2018-08-01 | |
| CVE-2023-28319 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser... | 7.5 | — | 2023-05-26 | |
| CVE-2016-8623 | A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger... | 7.5 | — | 2018-08-01 | |
| CVE-2016-0755 | The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticate... | 7.3 | — | 2016-01-29 | |
| CVE-2025-0725 | gzip integer overflow | 7.3 | — | 2025-02-05 | |
| CVE-2016-8617 | The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit s... | 7.0 | — | 2018-07-31 | |
| CVE-2017-1000101 | curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over tho... | 6.5 | — | 2017-10-05 | |
| CVE-2022-27776 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cook... | 6.5 | — | 2022-06-02 | |
| CVE-2017-2629 | curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh pro... | 6.5 | — | 2018-07-27 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | 6.5 | — | 2026-03-11 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | 6.5 | — | 2026-05-13 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | 6.5 | — | 2026-03-11 | |
| CVE-2024-8096 | OCSP stapling bypass with GnuTLS | 6.5 | — | 2024-09-11 | |
| CVE-2021-22922 | When curl is instructed to download content using the metalink feature, thecontents is verified against a hash... | 6.5 | — | 2021-08-05 | |
| CVE-2022-32206 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed... | 6.5 | — | 2022-07-07 | |
| CVE-2026-8458 | wrong reuse for different services | 6.5 | — | 2026-07-03 | |
| CVE-2023-46218 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more orig... | 6.5 | — | 2023-12-07 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | 6.3 | — | 2026-01-08 | |
| CVE-2023-28321 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil... | 5.9 | — | 2023-05-26 | |
| CVE-2022-43552 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols i... | 5.9 | — | 2023-02-09 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | 5.9 | — | 2026-05-13 | |
| CVE-2022-32208 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This... | 5.9 | — | 2022-07-07 | |
| CVE-2021-22947 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrad... | 5.9 | — | 2021-09-29 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | 5.9 | — | 2026-05-13 | |
| CVE-2023-28320 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend... | 5.9 | — | 2023-05-26 | |
| CVE-2016-8616 | A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive com... | 5.9 | — | 2018-08-01 | |
| CVE-2022-27774 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affect... | 5.7 | — | 2022-06-02 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | 5.3 | — | 2026-05-13 | |
| CVE-2017-9502 | In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows... | 5.3 | — | 2017-06-14 | |
| CVE-2025-14524 | bearer token leak on cross-protocol redirect | 5.3 | — | 2026-01-08 | |
| CVE-2021-22925 | curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used optio... | 5.3 | — | 2021-08-05 | |
| CVE-2026-3783 | token leak with redirect and netrc | 5.3 | — | 2026-03-11 | |
| CVE-2016-0754 | cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on... | 5.3 | — | 2016-01-29 | |
| CVE-2016-3739 | The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/... | 5.3 | — | 2016-05-20 | |
| CVE-2021-22923 | When curl is instructed to get content using the metalink feature, and a user name and password are used to do... | 5.3 | — | 2021-08-05 | |
| CVE-2020-8284 | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a gi... | 3.7 | — | 2020-12-14 | |
| CVE-2023-28322 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err... | 3.7 | — | 2023-05-26 | |
| CVE-2022-35252 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes t... | 3.7 | — | 2022-09-23 | |
| CVE-2021-22898 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CU... | 3.1 | — | 2021-06-11 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).