Version prüfen
curl --versionCVEs, die 7.64 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2019-5482 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | 9.8 | — | 2019-09-16 | |
| CVE-2026-19931 | Negotiate ambient user conn reuse | 9.8 | — | 2026-09-06 | |
| CVE-2022-32221 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask... | 9.8 | — | 2022-12-05 | |
| CVE-2019-5481 | Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. | 9.8 | — | 2019-09-16 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | 9.8 | — | 2026-07-03 | |
| CVE-2026-18924 | HTTP/2 server push UAF | 9.1 | — | 2026-09-06 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | 9.1 | — | 2026-07-03 | |
| CVE-2026-8924 | trailing dot domain super cookie | 9.1 | — | 2026-07-03 | |
| CVE-2023-27533 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may all... | 8.8 | — | 2023-03-30 | |
| CVE-2023-27534 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be... | 8.8 | — | 2023-03-30 | |
| CVE-2024-2398 | HTTP/2 push headers memory-leak | 8.6 | — | 2024-03-27 | |
| CVE-2026-82209 | domain-scoped PSL domain cookie | 8.2 | — | 2026-09-06 | |
| CVE-2022-22576 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse... | 8.1 | — | 2022-05-26 | |
| CVE-2026-8286 | wrong STARTTLS connection reuse | 8.1 | — | 2026-07-03 | |
| CVE-2020-8177 | curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that c... | 7.8 | — | 2020-12-14 | |
| CVE-2019-5443 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/l... | 7.8 | — | 2019-07-02 | |
| CVE-2022-27782 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that... | 7.5 | — | 2022-06-02 | |
| CVE-2021-22946 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP,... | 7.5 | — | 2021-09-29 | |
| CVE-2026-80230 | OpenSSL pinning bypass | 7.5 | — | 2026-09-06 | |
| CVE-2021-22926 | libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done wi... | 7.5 | — | 2021-08-05 | |
| CVE-2026-5773 | wrong reuse of SMB connection | 7.5 | — | 2026-05-13 | |
| CVE-2022-27781 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a... | 7.5 | — | 2022-06-02 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | 7.5 | — | 2026-07-03 | |
| CVE-2023-28319 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser... | 7.5 | — | 2023-05-26 | |
| CVE-2020-8169 | curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial... | 7.5 | — | 2020-12-14 | |
| CVE-2025-0725 | gzip integer overflow | 7.3 | — | 2025-02-05 | |
| CVE-2022-27776 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cook... | 6.5 | — | 2022-06-02 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | 6.5 | — | 2026-03-11 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | 6.5 | — | 2026-05-13 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | 6.5 | — | 2026-03-11 | |
| CVE-2024-8096 | OCSP stapling bypass with GnuTLS | 6.5 | — | 2024-09-11 | |
| CVE-2021-22922 | When curl is instructed to download content using the metalink feature, thecontents is verified against a hash... | 6.5 | — | 2021-08-05 | |
| CVE-2022-32206 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed... | 6.5 | — | 2022-07-07 | |
| CVE-2026-8458 | wrong reuse for different services | 6.5 | — | 2026-07-03 | |
| CVE-2023-46218 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more orig... | 6.5 | — | 2023-12-07 | |
| CVE-2023-23916 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "ch... | 6.5 | — | 2023-02-23 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | 6.3 | — | 2026-01-08 | |
| CVE-2023-28321 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil... | 5.9 | — | 2023-05-26 | |
| CVE-2022-43552 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols i... | 5.9 | — | 2023-02-09 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | 5.9 | — | 2026-05-13 | |
| CVE-2022-32208 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This... | 5.9 | — | 2022-07-07 | |
| CVE-2021-22947 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrad... | 5.9 | — | 2021-09-29 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | 5.9 | — | 2026-05-13 | |
| CVE-2023-28320 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend... | 5.9 | — | 2023-05-26 | |
| CVE-2022-27774 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affect... | 5.7 | — | 2022-06-02 | |
| CVE-2025-15079 | libssh global known_hosts override | 5.3 | — | 2026-01-08 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | 5.3 | — | 2026-05-13 | |
| CVE-2025-14524 | bearer token leak on cross-protocol redirect | 5.3 | — | 2026-01-08 | |
| CVE-2021-22925 | curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used optio... | 5.3 | — | 2021-08-05 | |
| CVE-2021-22897 | curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code... | 5.3 | — | 2021-06-11 | |
| CVE-2026-3783 | token leak with redirect and netrc | 5.3 | — | 2026-03-11 | |
| CVE-2021-22923 | When curl is instructed to get content using the metalink feature, and a user name and password are used to do... | 5.3 | — | 2021-08-05 | |
| CVE-2020-8284 | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a gi... | 3.7 | — | 2020-12-14 | |
| CVE-2023-28322 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err... | 3.7 | — | 2023-05-26 | |
| CVE-2022-35252 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes t... | 3.7 | — | 2022-09-23 | |
| CVE-2019-5435 | An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. | 3.7 | — | 2019-05-28 | |
| CVE-2021-22898 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CU... | 3.1 | — | 2021-06-11 | |
| CVE-2025-15224 | libssh key passphrase bypass without agent set | 3.1 | — | 2026-01-08 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).