curl / Docs / Vulnerability table / 7.10.7 vulnerabilities

Vulnerabilities in curl 7.10.7

curl version 7.10.7 was released on August 15 2003

It has the following 51 published security problems.

S	Flaw	First	Last
M	CVE-2026-11856: cross-origin Digest auth state leak	7.10.6	8.20.0
L	CVE-2026-8932: incomplete mTLS config matching in conn reuse	7.7	8.20.0
M	CVE-2026-5545: wrong reuse of HTTP Negotiate connection	7.10.6	8.19.0
L	CVE-2026-3784: wrong proxy connection reuse with credentials	7.7	8.18.0
M	CVE-2026-1965: bad reuse of HTTP Negotiate connection	7.10.6	8.18.0
L	CVE-2025-0725: gzip integer overflow	7.10.5	8.11.1
L	CVE-2023-38546: cookie injection with none file	7.9.1	8.3.0
L	CVE-2023-28322: more POST-after-PUT confusion	7.7	8.0.1
L	CVE-2023-28320: siglongjmp race condition	7.9.8	8.0.1
L	CVE-2023-27533: TELNET option IAC injection	7.7	7.88.1
M	CVE-2022-32221: POST following PUT confusion	7.7	7.85.0
L	CVE-2022-35252: control code in cookie denial of service	4.9	7.84.0
L	CVE-2022-27776: Auth/cookie leak on redirect	4.9	7.82.0
M	CVE-2022-27774: Credential leak on redirect	4.9	7.82.0
M	CVE-2021-22925: TELNET stack contents disclosure again	7.7	7.77.0
M	CVE-2021-22924: Bad connection reuse due to flawed path name checks	7.10.4	7.77.0
M	CVE-2021-22898: TELNET stack contents disclosure	7.7	7.76.1
L	CVE-2021-22876: Automatic referer leaks credentials	7.1.1	7.75.0
L	CVE-2020-8284: trusting FTP PASV responses	4.0	7.73.0
L	CVE-2018-1000007: HTTP authentication leak in redirects	6.0	7.57.0
M	CVE-2017-1000254: FTP PWD response parser out of bounds read	7.7	7.55.1
M	CVE-2017-7407: --write-out out of buffer read	6.5	7.53.1
M	CVE-2016-9586: printf floating point buffer overflow	5.4	7.51.0
H	CVE-2016-8615: cookie injection for other servers	4.9	7.50.3
M	CVE-2016-8616: case insensitive password comparison	7.7	7.50.3
M	CVE-2016-8617: OOB write via unchecked multiplication	7.8.1	7.50.3
M	CVE-2016-8618: double free in curl_maprintf	5.4	7.50.3
H	CVE-2016-8619: double free in krb5 code	7.3	7.50.3
H	CVE-2016-8623: Use after free via shared cookies	7.10.7	7.50.3
M	CVE-2016-8624: invalid URL parsing with '#'	6.0	7.50.3
H	CVE-2016-5419: TLS session resumption client cert bypass	5.0	7.50.0
M	CVE-2016-5420: Reusing connections with wrong client cert	7.7	7.50.0
H	CVE-2016-0754: remote filename path traversal in curl tool for Windows	4.0	7.46.0
M	CVE-2016-0755: NTLM credentials not-checked for proxy connection reuse	7.10.7	7.46.0
H	CVE-2015-3153: sensitive HTTP server headers also sent to proxies	4.0	7.42.0
M	CVE-2015-3148: Negotiate not treated as connection-oriented	7.10.6	7.41.0
M	CVE-2015-3143: Reusing authenticated connection when unauthenticated	7.10.6	7.41.0
H	CVE-2014-8150: URL request injection	6.0	7.39.0
M	CVE-2014-3613: cookie leak with IP address as domain	4.0	7.37.1
M	CVE-2014-0139: IP address wildcard certificate validation	7.10.3	7.35.0
M	CVE-2014-0138: wrong reuse of connections	7.10.6	7.35.0
M	CVE-2014-0015: reuse of wrong HTTP NTLM connection	7.10.6	7.34.0
H	CVE-2013-2174: URL decode buffer boundary flaw	7.7	7.30.0
H	CVE-2013-1944: cookie domain tailmatch	4.7	7.29.0
H	CVE-2011-3389: SSL CBC IV vulnerability	7.10.6	7.23.1
M	CVE-2011-2192: inappropriate GSSAPI delegation	7.10.6	7.21.6
H	CVE-2010-0734: data callback excessive length	7.10.5	7.19.7
H	CVE-2009-2417: embedded zero in cert name	7.4	7.19.5
M	CVE-2009-0037: Arbitrary File Access	5.11	7.19.3
H	CVE-2005-3185: NTLM Buffer Overflow	7.10.6	7.14.1
H	CVE-2005-0490: Authentication Buffer Overflows	7.3	7.13.0

Further details

CVE data for 7.10.7 provided as JSON.

Changelog for curl 7.10.7

See vulnerability summary for the previous release: 7.10.6 or the subsequent release: 7.10.8