Every CVE Search/ Get API key

CVE-2014-8150

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy,...

4.3 MediumFix available

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Exploit likelihood

6.81%Up 2.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Record
CVE-2014-8150
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Record
CVE-2014-8150
Updated
2026-11-02
EUVDEUVD-2014-7992 No score

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Record
EUVD-2014-7992
Updated
2026-11-03
GitHub AdvisoriesGHSA-rhch-32f3-p669 No score

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy,...

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Record
GHSA-rhch-32f3-p669
Updated
2026-11-02
OSVCURL-CVE-2014-8150 No score

URL request injection

When libcurl sends a request to a server via an HTTP proxy, it copies the entire URL into the request and sends if off.

If the given URL contains line feeds and carriage returns those are sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL.

Many programs allow some kind of external sources to set the URL or provide partial pieces for the URL to ask for, and if the URL as received from the user is not stripped good enough this flaw allows malicious users to do additional requests in a way that was not intended, or to insert request headers into the request that the program did not intend.

Record
CURL-CVE-2014-8150
Updated
2026-11-02
OSV No score

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Record
CVE-2014-8150
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-8150 No score

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Record
DEBIAN-CVE-2014-8150
Updated
2026-11-02
OSVMGASA-2015-0020 No score

Updated curl packages fix CVE-2014-8150

Updated curl packages fix security vulnerability:

When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL (CVE-2014-8150).

Record
MGASA-2015-0020
Updated
2026-11-02
OSVopenSUSE-SU-2024:10303-1 No score

curl-7.51.0-1.1 on GA media

These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10303-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-8150 No score

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Record
UBUNTU-CVE-2014-8150
Updated
2026-11-02
OSVUSN-2474-1 No score

curl vulnerability

Andrey Labunets discovered that curl incorrectly handled certain URLs when using a proxy server. If a user or automated system were tricked into using a specially crafted URL, an attacker could possibly use this issue to inject arbitrary HTTP requests.

Record
USN-2474-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Debian:12
 before 7.38.0-4
7.38.0-4
curl
Debian:13
 before 7.38.0-4
7.38.0-4
curl
Debian:14
 before 7.38.0-4
7.38.0-4
curl
Debian:6.0
 before 7.21.0-2.1+squeeze11, plus listed versions
7.21.0-17.21.0-27.21.0-2.1+squeeze17.21.0-2.1+squeeze107.21.0-2.1+squeeze2
Show 7 moreShow less
7.21.0-2.1+squeeze37.21.0-2.1+squeeze47.21.0-2.1+squeeze57.21.0-2.1+squeeze67.21.0-2.1+squeeze77.21.0-2.1+squeeze87.21.0-2.1+squeeze9
7.21.0-2.1+squeeze11
curl
Debian:7
 before 7.26.0-1+wheezy12, plus listed versions
7.26.0-1+wheezy107.26.0-1+wheezy117.26.0-1+wheezy27.26.0-1+wheezy37.26.0-1+wheezy4
Show 5 moreShow less
7.26.0-1+wheezy57.26.0-1+wheezy67.26.0-1+wheezy77.26.0-1+wheezy87.26.0-1+wheezy9
7.26.0-1+wheezy12
curl
Mageia:4
 before 7.34.0-1.5.mga4
7.34.0-1.5.mga4
curl-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
curl
Red Hat:enterprise_linux:6::client
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl
Red Hat:enterprise_linux:6::client
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
Show 30 moreShow less
Affected packages
PackageAffectedFixed
curl-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
curl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
curl
Red Hat:enterprise_linux:6::server
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
curl-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl
Red Hat:enterprise_linux:6::server
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
curl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
curl-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
libcurl-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 5 CVEs
 before 0:7.19.7-46.el6
0:7.19.7-46.el6
curl-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl
Red Hat:enterprise_linux:7::client
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl
Red Hat:enterprise_linux:7::client
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
libcurl-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 5 CVEs
 before 0:7.29.0-25.el7
0:7.29.0-25.el7
curl
Ubuntu:14.04:LTS
 before 7.35.0-1ubuntu2.3, plus listed versions
7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu27.35.0-1ubuntu2.17.35.0-1ubuntu2.2
7.35.0-1ubuntu2.3
curl
openSUSE:Tumbleweed
From an advisory covering 32 CVEs
 before 7.51.0-1.1
7.51.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8150 is a medium vulnerability (CVSS 4.3) in Haxx Libcurl, published January 8, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.81%, the 94th percentile. Fixed in curl 7.38.0-4.

References

Show 103 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open