curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Apr 23, 2018 | Apr 23, 2018 |
| Amazon_linux | — | Upgrade curl | Mar 23, 2017 | Dec 21, 2016 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Mar 28, 2017 | Mar 28, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 23, 2018 |
| Debian | — | Upgrade curl | Mar 31, 2017 | Dec 21, 2016 |
| Freebsd | — | Upgrade curl | Dec 22, 2016 | Dec 22, 2016 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Jan 19, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Jul 3, 2018 | Apr 23, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Jul 3, 2018 | Apr 23, 2018 |
| Oracle Solaris | — | Upgrade web/curl to version 7.45.0-0.175.3.18.0.1.0 on Solaris 11.3 | May 29, 2017 | May 29, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 23, 2018 |
| Suse | — | Upgrade sles12sp2-docker-imageUpgrade sles12sp1-docker-imageUpgrade libcurl4-openssl1Upgrade curl-openssl1Upgrade sles12-docker-imageUpgrade libcurl4-openssl1-32bitUpgrade libcurl4-x86Upgrade libcurl4Upgrade libcurl-develUpgrade libcurl4-32bitUpgrade curlUpgrade libcurl4-openssl1-x86 | Apr 19, 2017 | Dec 21, 2016 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade libcurl3-nssUpgrade curlUpgrade libcurl3 | Oct 10, 2017 | Dec 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub