When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Feb 5, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ecs-service-connect-agent | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ecs-service-connect-agent | Jan 12, 2026 | Feb 5, 2025 |
| Debian | — | No solution existsUpgrade curl | May 15, 2025 | Feb 5, 2025 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | May 13, 2025 | Feb 5, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Apr 11, 2025 | Feb 5, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | May 7, 2025 | Feb 5, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libcurlUpgrade curl | Apr 1, 2025 | Feb 5, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.2.9Upgrade Splunk Enterprise to version 9.2.8Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.4.4Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.3.6Upgrade Splunk Enterprise to version 9.4.5 | Jul 30, 2026 | Feb 5, 2025 |
| Suse | — | Upgrade libcurl-devel-32bitUpgrade libcurl4-32bitUpgrade libcurl-develUpgrade curlUpgrade libcurl4 | Feb 10, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub