Every CVE Search/ Get API key

CVE-2005-3185

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2)...

7.5 HighFix available

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Exploit likelihood

5.19%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Record
CVE-2005-3185
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Record
CVE-2005-3185
Updated
2026-11-02
EUVDEUVD-2005-3184 No score

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Record
EUVD-2005-3184
Updated
2026-11-03
GitHub AdvisoriesGHSA-pr2f-jh2p-p39m No score

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2)...

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Record
GHSA-pr2f-jh2p-p39m
Weakness
CWE-119
Updated
2026-11-02
OSVCURL-CVE-2005-3185 No score

NTLM Buffer Overflow

libcurl's NTLM function can overflow a stack-based buffer if given a too long username or domain name. This would happen if you enable NTLM authentication and either:

A - pass in a username and domain name to libcurl that together are longer than 192 bytes

B - allow (lib)curl to follow HTTP "redirects" (Location: and the appropriate HTTP 30x response code) and the new URL contains a URL with a username and domain name that together are longer than 192 bytes

Record
CURL-CVE-2005-3185
Updated
2026-11-02
OSV No score

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Record
CVE-2005-3185
Updated
2026-11-02
OSVDEBIAN-CVE-2005-3185 No score

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Record
DEBIAN-CVE-2005-3185
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Debian:12
 before 7.15.0-1
7.15.0-1
curl
Debian:13
 before 7.15.0-1
7.15.0-1
curl
Debian:14
 before 7.15.0-1
7.15.0-1
wget
Debian:12
 before 1.10.2-1
1.10.2-1
wget
Debian:13
 before 1.10.2-1
1.10.2-1
wget
Debian:14
 before 1.10.2-1
1.10.2-1
curl
Debian:3.0
 before 7.9.5-1woody2, plus listed versions
7.9.5-17.9.5-1woody1
7.9.5-1woody2
curl
Debian:3.1
 before 7.13.2-2sarge5, plus listed versions
7.13.2-27.13.2-2sarge17.13.2-2sarge27.13.2-2sarge37.13.2-2sarge4
7.13.2-2sarge5
wget
Red Hat:enterprise_linux:3::as
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
wget-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
Show 14 moreShow less
Affected packages
PackageAffectedFixed
wget
Red Hat:enterprise_linux:3::desktop
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
wget-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
wget
Red Hat:enterprise_linux:3::es
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
wget-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
wget
Red Hat:enterprise_linux:3::ws
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
wget-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:1.10.2-0.30E
0:1.10.2-0.30E
wget
Red Hat:enterprise_linux:4::as
 before 0:1.10.2-0.40E
0:1.10.2-0.40E
wget-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:1.10.2-0.40E
0:1.10.2-0.40E
wget
Red Hat:enterprise_linux:4::desktop
 before 0:1.10.2-0.40E
0:1.10.2-0.40E
wget-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:1.10.2-0.40E
0:1.10.2-0.40E
wget
Red Hat:enterprise_linux:4::es
 before 0:1.10.2-0.40E
0:1.10.2-0.40E
wget-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:1.10.2-0.40E
0:1.10.2-0.40E
wget
Red Hat:enterprise_linux:4::ws
 before 0:1.10.2-0.40E
0:1.10.2-0.40E
wget-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:1.10.2-0.40E
0:1.10.2-0.40E

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-3185 is a high vulnerability (CVSS 7.5) in Curl, published October 13, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.19%, the 92nd percentile. Fixed in curl 7.15.0-1.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open