Every CVE Search/ Get API key

CVE-2016-9594

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal...

6.5 MediumFix available

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

2.22%Up 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

CVE List Score used 6.5

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Record
CVE-2016-9594
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-665
Updated
2026-11-02
EUVDEUVD-2016-10398 6.5

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Record
EUVD-2016-10398
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-qq6c-xrmh-q72x 8.1

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal...

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Record
GHSA-qq6c-xrmh-q72x
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-665
Updated
2026-11-02
NVD 6.5

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Record
CVE-2016-9594
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-665
Updated
2026-11-02
OSVALPINE-CVE-2016-9594 8.1

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Record
ALPINE-CVE-2016-9594
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2016-9594 8.1

CVE-2016-9594 does not affect BellSoft software

Record
BELL-CVE-2016-9594
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.1

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Record
CVE-2016-9594
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCURL-CVE-2016-9594 No score

uninitialized random

libcurl's (new) internal function that returns a good 32-bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to.

This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary strings in HTTP formposts and more. Having a weak or virtually non-existent random there makes these operations vulnerable.

This function is brand new in 7.52.0 and is the result of an overhaul to make sure libcurl uses strong random as much as possible - provided by the backend TLS crypto libraries when present.

Record
CURL-CVE-2016-9594
Updated
2026-11-02
OSVopenSUSE-SU-2024:10582-1 No score

curl-7.79.1-1.1 on GA media

These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10582-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.10
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.11
 before 7.52.1
7.52.1
curl
Alpine:v3.12
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.13
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.14
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.15
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.16
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.17
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.18
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.19
 before 7.52.1-r0
7.52.1-r0
Show 14 moreShow less
Affected packages
PackageAffectedFixed
curl
Alpine:v3.2
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.20
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.21
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.22
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.23
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.24
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.3
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.4
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.5
 before 7.52.1-r0
7.52.1-r0
curl
Alpine:v3.6
 before 7.52.1
7.52.1
curl
Alpine:v3.7
 before 7.52.1
7.52.1
curl
Alpine:v3.8
 before 7.52.1
7.52.1
curl
Alpine:v3.9
 before 7.52.1-r0
7.52.1-r0
curl
openSUSE:Tumbleweed
From an advisory covering 48 CVEs
 before 7.79.1-1.1
7.79.1-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-9594 is a medium vulnerability (CVSS 6.5) in Curl, published December 23, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. Fixed in curl 7.52.1-r0.

References

Show 52 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open