IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.3Orta

CVE-2022-27780

https://github.com/curl/curl; haxx curl; netapp solidfire_\&_hci_storage_node; netapp ontap_9 Yayım: (4 yıl önce)

Açıklama

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

Zayıflık türü (CWE): CWE-177

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
haxx curl < 7.86.0
netapp hci baseboard management controller h300s
netapp hci_bootstrap_os 0
netapp ontap_9 0
netapp solidfire_\&_hci_management_node h300s, h410s, h500s, h700s
netapp solidfire_\&_hci_storage_node 0
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5
— https://github.com/curl/curl Fixed in 7.83.1

Kaynaklar ve yamalar

Aynı üründe son açıklar — curl / libcurl

8.1Yüksek
CVE-2026-107929

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1Yüksek
CVE-2026-107928

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5Yüksek
CVE-2026-94266

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Kritik
CVE-2026-94265

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Yüksek
CVE-2026-92391

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS
7.5Yüksek
CVE-2026-92390

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…