Every CVE Search/ Get API key

CVE-2016-5420

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS...

7.5 HighFix available

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

15.4%Up 11.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
CVE-2016-5420
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-285
Updated
2026-11-02
CVE List No score

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
CVE-2016-5420
Updated
2026-11-02
EUVDEUVD-2016-6365 No score

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
EUVD-2016-6365
Updated
2026-11-03
GitHub AdvisoriesGHSA-qpjh-642g-hgh8 7.5

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS...

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
GHSA-qpjh-642g-hgh8
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-285
Updated
2026-11-02
OSVALPINE-CVE-2016-5420 7.5

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
ALPINE-CVE-2016-5420
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2016-5420 7.5

CVE-2016-5420 does not affect BellSoft software

Record
BELL-CVE-2016-5420
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 14 moreShow less
OSV 7.5

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
CVE-2016-5420
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2016-5420 7.5

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
DEBIAN-CVE-2016-5420
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2016:2575 4.8

Red Hat Security Advisory: curl security, bug fix, and enhancement update

Record
RHSA-2016:2575
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2018:3558 8.1

Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update

Record
RHSA-2018:3558
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-5420 7.5

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Record
UBUNTU-CVE-2016-5420
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVCURL-CVE-2016-5420 No score

Reusing connections with wrong client cert

libcurl did not consider client certificates when reusing TLS connections.

libcurl supports reuse of established connections for subsequent requests. It does this by keeping a few previous connections "alive" in a connection pool so that a subsequent request that can use one of them instead of creating a new connection.

When using a client certificate for a connection that was then put into the connection pool, that connection could then wrongly get reused in a subsequent request to that same server that either did not use a client certificate at all or that asked to use a different client certificate thus trying to tell the user that it is a different entity.

This mistakenly using the wrong connection could of course lead to applications sending requests to the wrong realms of the server using authentication that it was not supposed to have for those operations.

Record
CURL-CVE-2016-5420
Updated
2026-11-02
OSVMGASA-2016-0285 No score

Updated curl packages fix security vulnerability

libcurl before 7.50.1 would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate) (CVE-2016-5419).

In libcurl before 7.50.1, when using a client certificate for a connection that was then put into the connection pool, that connection could then wrongly get reused in a subsequent request to that same server. This mistakenly using the wrong connection could lead to applications sending requests to the wrong realms of the server using authentication that it wasn't supposed to have for those operations (CVE-2016-5420).

libcurl before 7.50.1 is vulnerable to a use-after-free flaw in curl_easy_perform() (CVE-2016-5421).

Record
MGASA-2016-0285
Updated
2026-11-02
OSVSUSE-SU-2016:2155-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389)
  • CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390)
Record
SUSE-SU-2016:2155-1
Updated
2026-11-02
OSVSUSE-SU-2016:2330-1 No score

Security update for curl

This update for curl fixes the following issues:

Security issues fixed:

  • CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389)
  • CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390)
  • CVE-2016-5421: use of connection struct after free (bsc#991391)
  • CVE-2016-7141: Fixed incorrect reuse of client certificates with NSS (bsc#997420)

Also the following bug was fixed:

  • fixing a performance issue (bsc#991746)
Record
SUSE-SU-2016:2330-1
Updated
2026-11-02
OSVSUSE-SU-2016:2449-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389)
  • CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390)
  • CVE-2016-7141: Fixed incorrect reuse of client certificates (bsc#997420).
Record
SUSE-SU-2016:2449-1
Updated
2026-11-02
OSVSUSE-SU-2016:2700-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2016-8624: invalid URL parsing with '#' (bsc#1005646)
  • CVE-2016-8623: Use-after-free via shared cookies (bsc#1005645)
  • CVE-2016-8621: curl_getdate read out of bounds (bsc#1005642)
  • CVE-2016-8619: double-free in krb5 code (bsc#1005638)
  • CVE-2016-8618: double-free in curl_maprintf (bsc#1005637)
  • CVE-2016-8617: OOB write via unchecked multiplication (bsc#1005635)
  • CVE-2016-8616: case insensitive password comparison (bsc#1005634)
  • CVE-2016-8615: cookie injection for other servers (bsc#1005633)
  • CVE-2016-7167: escape and unescape integer overflows (bsc#998760)
  • CVE-2016-7141: Fixed incorrect reuse of client certificates with NSS not fixed in CVE-2016-5420 (bsc#997420)
Record
SUSE-SU-2016:2700-1
Updated
2026-11-02
OSVSUSE-SU-2017:2699-1 No score

Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

util-linux:

  • CVE-2015-5218
  • CVE-2016-5011
  • CVE-2017-2616

cracklib:

  • CVE-2016-6318

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • openldap2
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • shadow
  • zypper
Record
SUSE-SU-2017:2699-1
Updated
2026-11-02
OSVSUSE-SU-2017:2700-1 No score

Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

expat:

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306
  • CVE-2016-7056
  • CVE-2016-8610
  • CVE-2017-3731

cracklib:

  • CVE-2016-6318

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

util-linux:

  • CVE-2016-5011
  • CVE-2017-2616

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

update-alternatives:

  • CVE-2015-0860

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • lua51
  • lvm2
  • netcfg
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • sg3_utils
  • shadow
  • zypper
Record
SUSE-SU-2017:2700-1
Updated
2026-11-02
OSVUSN-3048-1 No score

curl vulnerabilities

Bru Rom discovered that curl incorrectly handled client certificates when resuming a TLS session. (CVE-2016-5419)

It was discovered that curl incorrectly handled client certificates when reusing TLS connections. (CVE-2016-5420)

Marcelo Echeverria and Fernando Muñoz discovered that curl incorrectly reused a connection struct, contrary to expectations. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5421)

Record
USN-3048-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.10
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.11
 before 7.50.1
7.50.1
curl
Alpine:v3.12
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.13
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.14
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.15
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.16
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.17
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.18
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.19
 before 7.50.1-r0
7.50.1-r0
Show 92 moreShow less
Affected packages
PackageAffectedFixed
curl
Alpine:v3.2
 before 7.49.1-r1
7.49.1-r1
curl
Alpine:v3.20
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.21
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.22
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.23
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.24
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.3
 before 7.49.1-r1
7.49.1-r1
curl
Alpine:v3.4
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.5
 before 7.50.1-r0
7.50.1-r0
curl
Alpine:v3.6
 before 7.50.1
7.50.1
curl
Alpine:v3.7
 before 7.50.1
7.50.1
curl
Alpine:v3.8
 before 7.50.1
7.50.1
curl
Alpine:v3.9
 before 7.50.1-r0
7.50.1-r0
curl
Debian:12
 before 7.50.1-1
7.50.1-1
curl
Debian:13
 before 7.50.1-1
7.50.1-1
curl
Debian:14
 before 7.50.1-1
7.50.1-1
curl
Debian:7
From an advisory covering 2 CVEs
 before 7.26.0-1+wheezy14, plus listed versions
7.26.0-1+wheezy107.26.0-1+wheezy117.26.0-1+wheezy127.26.0-1+wheezy137.26.0-1+wheezy2
Show 7 moreShow less
7.26.0-1+wheezy37.26.0-1+wheezy47.26.0-1+wheezy57.26.0-1+wheezy67.26.0-1+wheezy77.26.0-1+wheezy87.26.0-1+wheezy9
7.26.0-1+wheezy14
curl
Debian:8
From an advisory covering 3 CVEs
 before 7.38.0-4+deb8u4, plus listed versions
7.38.0-47.38.0-4+deb8u17.38.0-4+deb8u27.38.0-4+deb8u3
7.38.0-4+deb8u4
curl
Mageia:5
From an advisory covering 3 CVEs
 before 7.40.0-3.4.mga5
7.40.0-3.4.mga5
curl-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
curl
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
curl-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
curl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
curl
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
curl-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
curl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
curl-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
libcurl-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:7.29.0-35.el7
0:7.29.0-35.el7
httpd24-curl
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-curl-debuginfo
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-httpd
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-devel
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-manual
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-tools
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-libcurl
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-libcurl-devel
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-libnghttp2
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-libnghttp2-devel
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-mod_ldap
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el6
1:2.4.34-7.el6
httpd24-mod_session
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-mod_ssl
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el6
1:2.4.34-7.el6
httpd24-nghttp2
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-nghttp2-debuginfo
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-curl
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-curl-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-httpd
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-manual
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-tools
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-libcurl
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-libcurl-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-libnghttp2
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
httpd24-libnghttp2-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
httpd24-mod_ldap
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-mod_md
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el7
1:2.4.34-7.el7
httpd24-mod_session
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-mod_ssl
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el7
1:2.4.34-7.el7
httpd24-nghttp2
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
httpd24-nghttp2-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
curl
SUSE:Studio Onsite 1.3
From an advisory covering 2 CVEs
 before 7.19.7-1.20.42.1
7.19.7-1.20.42.1
curl
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 4 CVEs
 before 7.37.0-28.1
7.37.0-28.1
curl
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 4 CVEs
 before 7.37.0-28.1
7.37.0-28.1
curl
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 4 CVEs
 before 7.37.0-28.1
7.37.0-28.1
curl
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 4 CVEs
 before 7.37.0-28.1
7.37.0-28.1
curl
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl-openssl1
SUSE:Linux Enterprise Server 11-SECURITY
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:OpenStack Cloud 5
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Manager 2.1
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Manager Proxy 2.1
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl-openssl1
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl-openssl1
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 3 CVEs
 before 7.19.7-1.61.1
7.19.7-1.61.1
curl
SUSE:Studio Onsite 1.3
From an advisory covering 13 CVEs
 before 7.19.7-1.20.47.2
7.19.7-1.20.47.2
curl
Ubuntu:14.04:LTS
 before 7.35.0-1ubuntu2.8, plus listed versions
7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2
Show 6 moreShow less
7.35.0-1ubuntu2.17.35.0-1ubuntu2.27.35.0-1ubuntu2.37.35.0-1ubuntu2.57.35.0-1ubuntu2.67.35.0-1ubuntu2.7
7.35.0-1ubuntu2.8
curl
Ubuntu:16.04:LTS
 before 7.47.0-1ubuntu2.1, plus listed versions
7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu2
7.47.0-1ubuntu2.1
curl
Ubuntu:14.04:LTS
From an advisory covering 3 CVEs
 before 7.35.0-1ubuntu2.8, plus listed versions
7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2
Show 6 moreShow less
7.35.0-1ubuntu2.17.35.0-1ubuntu2.27.35.0-1ubuntu2.37.35.0-1ubuntu2.57.35.0-1ubuntu2.67.35.0-1ubuntu2.7
7.35.0-1ubuntu2.8
curl
Ubuntu:16.04:LTS
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.1, plus listed versions
7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu2
7.47.0-1ubuntu2.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-5420 is a high vulnerability (CVSS 7.5) in Haxx Libcurl, published August 3, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.4%, the 96th percentile. Fixed in curl 7.50.1-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 199 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open