Libcurl vulnerabilities

2 known vulnerabilities in Libcurl from Haxx. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  curl: Buffer Copy without Checking Size of Input

  CVE-2025-0725Feb 5, 2025CurlEPSS 1.79%

  When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

• 9.8 Critical severity

  curl: Out-of-bounds Write

  CVE-2023-38545Oct 18, 2023CurlEPSS 78.3%

  This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host nam