curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-curl | Aug 22, 2024 | Dec 5, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-curlamazon-linux-ami-2-upgrade-curl-debuginfoamazon-linux-ami-2-upgrade-libcurlamazon-linux-ami-2-upgrade-libcurl-devel | Dec 7, 2022 | Dec 5, 2022 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-curlamazon-linux-2023-upgrade-curl-debuginfoamazon-linux-2023-upgrade-curl-debugsourceamazon-linux-2023-upgrade-curl-minimalamazon-linux-2023-upgrade-curl-minimal-debuginfoamazon-linux-2023-upgrade-libcurlamazon-linux-2023-upgrade-libcurl-debuginfoamazon-linux-2023-upgrade-libcurl-develamazon-linux-2023-upgrade-libcurl-minimalamazon-linux-2023-upgrade-libcurl-minimal-debuginfo | Feb 17, 2025 | Oct 26, 2022 | |
| Apple Osx Curl | apple-osx-upgrade-latest | Jan 24, 2023 | Dec 5, 2022 | |
| Debian | debian-upgrade-curl | Jul 30, 2024 | Dec 5, 2022 | |
| Freebsd | freebsd-upgrade-package-curl | Dec 14, 2022 | Dec 14, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-curl | Dec 19, 2022 | Dec 5, 2022 | |
| Splunk | splunk-upgrade-latest | Sep 30, 2025 | Dec 5, 2022 | |
| Suse | — | suse-upgrade-curlsuse-upgrade-libcurl-develsuse-upgrade-libcurl4suse-upgrade-libcurl4-32bit | Jun 13, 2023 | Dec 5, 2022 |
| Ubuntu | ubuntu-upgrade-curlubuntu-upgrade-libcurl3-gnutlsubuntu-upgrade-libcurl3-nssubuntu-upgrade-libcurl4 | Oct 27, 2022 | Oct 26, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Dec 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub