libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Feb 20, 2018 | Jan 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade curl-debuginfoUpgrade nss-pem-debuginfoUpgrade nss-pemUpgrade libcurl-develUpgrade libcurlUpgrade curl | Apr 27, 2020 | Jan 24, 2018 |
| Amazon_linux | — | Upgrade curl | Feb 22, 2018 | Jan 24, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 24, 2018 |
| Centos_linux | — | Upgrade nss-pemUpgrade curl-debuginfoUpgrade libcurl-develUpgrade nss-pem-debuginfoUpgrade libcurlUpgrade curl | Aug 28, 2019 | Jan 24, 2018 |
| Debian | — | Upgrade curl | Jan 27, 2018 | Jan 24, 2018 |
| Freebsd | — | Upgrade curl | Jan 27, 2018 | Jan 26, 2018 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Apr 9, 2018 | Jan 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libcurl-develUpgrade libcurlUpgrade curl | Dec 31, 2018 | Jan 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Dec 11, 2018 | Jan 24, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade curlUpgrade libcurlUpgrade libcurl-devel | Jan 9, 2019 | Jan 24, 2018 |
| Oracle Solaris | — | Upgrade web/curl to version 7.59.0-0.175.3.33.0.3.0 on Solaris 11.3Upgrade web/php-56 to version 5.6.34-0.175.3.31.0.2.0 on Solaris 11.3Upgrade web/php-71 to version 7.1.15-0.175.3.31.0.2.0 on Solaris 11.3 | Apr 18, 2018 | Jan 24, 2018 |
| Oracle_linux | — | Upgrade nss-pemUpgrade libcurlUpgrade curlUpgrade libcurl-devel | Nov 6, 2018 | Jan 24, 2018 |
| Redhat_linux | — | Upgrade libcurl-develUpgrade curl-debuginfoUpgrade nss-pem-debuginfoUpgrade curlUpgrade libcurlUpgrade nss-pemNo solution exists | Oct 31, 2018 | Jan 24, 2018 |
| Suse | — | Upgrade curlUpgrade curl-openssl1Upgrade libcurl-develUpgrade libcurl4Upgrade libcurl4-openssl1-32bitUpgrade libcurl4-openssl1Upgrade libcurl4-32bit | Jan 26, 2018 | Jan 24, 2018 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl3-gnutlsUpgrade curlUpgrade libcurl3 | Feb 1, 2018 | Jan 24, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub