CVE-2019-5481Critical· 9.8▾ MidnightDouble-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 1.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
7.5%
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
curl >= 7.52.0, <= 7.65.3fedora = 29fedora = 30fedora = 31cloud_backupsteelstoresolidfire_baseboard_management_controller_firmwarecommunications_operations_monitor = 3.4communications_operations_monitor = 4.0communications_operations_monitor = 4.1communications_operations_monitor = 4.2communications_operations_monitor = 4.3communications_session_border_controller = 8.3communications_session_border_controller = 8.4enterprise_manager_ops_center = 12.3.3enterprise_manager_ops_center = 12.4.0mysql_server >= 5.7.0, <= 5.7.28mysql_server >= 8.0.0, <= 8.0.18oss_support_tools = 20.0debian_linux = 9.0debian_linux = 10.0leap = 15.0leap = 15.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2019-5482Critical· 9.8Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-5443High· 7.8A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation
CVE-2019-5435Low· 3.7An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
CVE-2022-42915High· 8.1curl before 7.86.0 has a double free
CVE-2025-0665High· 7.0libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.
CVE-2025-0167Low· 3.4When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc f…