Every CVE Search/ Get API key

CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re...

4.0 MediumFix available

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

Exploit likelihood

5.60%Up 2.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

Record
CVE-2014-0015
CVSS 2.0
4.0 MediumAV:N/AC:H/Au:N/C:P/I:P/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

Record
CVE-2014-0015
Updated
2026-11-02
EUVDEUVD-2014-0116 No score

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

Record
EUVD-2014-0116
Updated
2026-11-03
GitHub AdvisoriesGHSA-93wp-ggwv-r77q No score

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re...

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

Record
GHSA-93wp-ggwv-r77q
Weakness
CWE-287
Updated
2026-11-02
OSVCURL-CVE-2014-0015 No score

reuse of wrong HTTP NTLM connection

libcurl can in some circumstances reuse the wrong connection when asked to do an NTLM-authenticated HTTP or HTTPS request.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that NTLM authenticates connections and not requests, contrary to how HTTP is designed to work and how other authentication methods work.

An application that allows NTLM and another auth method (the bug only triggers if more than one auth method is asked for) to a server (that responds wanting NTLM) with user1:password1 and then does another operation to the same server with user2:password2 (when the previous connection was left alive) - the second request reuses the same connection and since it then sees that the NTLM negotiation is already made, it sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1...

The set of auth methods to use is set with CURLOPT_HTTPAUTH.

Two common auth defines in libcurl are CURLAUTH_ANY and CURLAUTH_ANYSAFE. Both of them ask for NTLM and other methods and can therefore trigger this problem.

Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: CURLOPT_FRESH_CONNECT, CURLOPT_MAXCONNECTS and CURLMOPT_MAX_HOST_CONNECTIONS (if using the curl_multi API).

Record
CURL-CVE-2014-0015
Updated
2026-11-02
OSV No score

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

Record
CVE-2014-0015
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-0015 No score

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

Record
DEBIAN-CVE-2014-0015
Updated
2026-11-02
OSVMGASA-2014-0153 No score

Updated curl packages fix multiple vulnerabilities

Updated curl packages fix security vulnerabilities:

Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when asked to do transfers using other protocols than HTTP and FTP, causing a transfer that was initiated by an application to wrongfully re-use an existing connection to the same server that was authenticated using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139).

Record
MGASA-2014-0153
Updated
2026-11-02
OSVopenSUSE-SU-2024:10303-1 No score

curl-7.51.0-1.1 on GA media

These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10303-1
Updated
2026-11-02
OSVSUSE-SU-2015:0962-1 No score

Security update for curl

This curl update fixes the following security issues:

* bnc#868627: wrong re-use of connections (CVE-2014-0138).
* bnc#868629: IP address wildcard certificate validation
  (CVE-2014-0139).
* bnc#870444: --insecure option inappropriately enforcing security
  safeguard.

Security Issue references:

* CVE-2014-0138
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138>
* CVE-2014-0139
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139>
Record
SUSE-SU-2015:0962-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Debian:12
 before 7.35.0-1
7.35.0-1
curl
Debian:13
 before 7.35.0-1
7.35.0-1
curl
Debian:14
 before 7.35.0-1
7.35.0-1
curl
Debian:6.0
 before 7.21.0-2.1+squeeze7, plus listed versions
7.21.0-17.21.0-27.21.0-2.1+squeeze17.21.0-2.1+squeeze27.21.0-2.1+squeeze37.21.0-2.1+squeeze47.21.0-2.1+squeeze57.21.0-2.1+squeeze6
7.21.0-2.1+squeeze7
curl
Debian:7
 before 7.26.0-1+wheezy8, plus listed versions
7.26.0-1+wheezy27.26.0-1+wheezy37.26.0-1+wheezy47.26.0-1+wheezy57.26.0-1+wheezy67.26.0-1+wheezy7
7.26.0-1+wheezy8
curl
Mageia:3
From an advisory covering 3 CVEs
 before 7.28.1-6.4.mga3
7.28.1-6.4.mga3
curl
Mageia:4
From an advisory covering 3 CVEs
 before 7.34.0-1.2.mga4
7.34.0-1.2.mga4
curl
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
libcurl
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
Show 14 moreShow less
Affected packages
PackageAffectedFixed
libcurl-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
libcurl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
libcurl-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
libcurl
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
libcurl-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
libcurl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
libcurl-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:7.19.7-37.el6_5.3
0:7.19.7-37.el6_5.3
curl
openSUSE:Tumbleweed
From an advisory covering 32 CVEs
 before 7.51.0-1.1
7.51.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0015 is a medium vulnerability (CVSS 4.0) in Haxx Curl, published January 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.60%, the 92nd percentile. Fixed in curl 7.35.0-1.

References

Show 82 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open