cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
CVSS Details
- CVSS 3.1 Base Score: 4.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 30, 2017 | Feb 1, 2014 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Sep 22, 2014 | Feb 1, 2014 |
| Apple Osx Note | — | Apply OS X security update 2014-003Upgrade macOS to the latest version | Aug 28, 2015 | Feb 1, 2014 |
| Centos_linux | — | Upgrade libcurl-develUpgrade libcurlUpgrade curl | Dec 1, 2016 | Feb 1, 2014 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Feb 2, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Nov 25, 2014 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Feb 1, 2014 |
| Oracle Solaris | — | Upgrade web/curl to version 7.45.0-0.175.3.5.0.4.0 on Solaris 11.3Upgrade web/curl to version 7.21.2-0.175.1.18.0.3.0 on Solaris 11.1 | May 29, 2017 | Feb 1, 2014 |
| Oracle_linux | — | Upgrade libcurl-develUpgrade libcurlUpgrade curl | Oct 16, 2024 | Feb 2, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 29, 2014 |
| Suse | — | Upgrade libcurl4-openssl1-32bitUpgrade curl-openssl1Upgrade libcurl4-x86Upgrade libcurl4Upgrade libcurl4-openssl1Upgrade curlUpgrade libcurl4-32bitUpgrade libcurl-devel | Dec 18, 2015 | Jan 31, 2014 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade libcurl3Upgrade libcurl3-nss | Nov 8, 2024 | Feb 2, 2014 |
| Vmsa 2014 0012 | — | Upgrade VMware ESXi 5.5 to build number 2068190Upgrade VMware ESXi 5.1 to build number 2323236 | Oct 28, 2015 | Feb 1, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub