curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | May 29, 2018 | May 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade curlUpgrade curl-debuginfoUpgrade libcurlUpgrade libcurl-devel | Apr 27, 2020 | May 24, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 24, 2018 |
| Debian | — | Upgrade curl | Jul 30, 2024 | May 24, 2018 |
| Freebsd | — | Upgrade curl | May 17, 2018 | May 16, 2018 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Jun 20, 2018 | May 24, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 24, 2018 |
| Suse | — | Upgrade curlUpgrade libcurl-mini-develUpgrade libcurl-develUpgrade libcurl4-32bitUpgrade libcurl4Upgrade libcurl-devel-32bitUpgrade curl-miniUpgrade libcurl4-mini | Jun 10, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade libcurl3Upgrade libcurl3-nssUpgrade libcurl4Upgrade curl | May 23, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub