CVE-2014-3613
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names,...
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
Exploit likelihood
What each source reports
NVD Score used
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
- Record
CVE-2014-3613- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
- Record
CVE-2014-3613- Updated
- 2026-11-02
EUVDEUVD-2014-3577 No score
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
- Record
EUVD-2014-3577- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gcmw-6qh5-324w No score
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names,...
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
- Record
GHSA-gcmw-6qh5-324w- Updated
- 2026-11-02
OSVCURL-CVE-2014-3613 No score
cookie leak with IP address as domain
By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others.
For this problem to trigger, the client application must use the numerical IP address in the URL to access the site and the site must send back cookies to the site using domain= and a partial IP address.
Since libcurl wrongly approaches the IP address like it was a normal domain
name, a site at IP address 192.168.0.1 can set cookies for anything ending
with .168.0.1 thus fooling libcurl to send them also to for example
129.168.0.1.
The flaw requires dots to be present in the IP address, which restricts the
flaw to IPv4 literal addresses or IPv6 addresses using the somewhat unusual
"dotted-quad" style: ::ffff:192.0.2.128.
This is not believed to be done by typical sites as this is not supported by clients that adhere to the rules of the RFC 6265, and many sites are written to explicitly use their own specific named domain when sending cookies.
- Record
CURL-CVE-2014-3613- Updated
- 2026-11-02
OSV No score
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
- Record
CVE-2014-3613- Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2014-3613 No score
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
- Record
DEBIAN-CVE-2014-3613- Updated
- 2026-11-02
OSVMGASA-2014-0384 No score
Updated curl packages fix security vulnerabilities
Updated curl packages fix security vulnerabilities:
In cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application must use the numerical IP address in the URL to access the site (CVE-2014-3613).
- Record
MGASA-2014-0384- Updated
- 2026-11-02
OSVMGASA-2014-0385 No score
Updated curl packages fix security vulnerabilities
Updated curl packages fix security vulnerabilities:
In cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application must use the numerical IP address in the URL to access the site (CVE-2014-3613).
In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain (CVE-2014-3620).
- Record
MGASA-2014-0385- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10303-1 No score
curl-7.51.0-1.1 on GA media
These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10303-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3613 No score
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
- Record
UBUNTU-CVE-2014-3613- Updated
- 2026-11-02
OSVUSN-2346-1 No score
curl vulnerabilities
Tim Ruehsen discovered that curl incorrectly handled partial literal IP addresses. This could lead to the disclosure of cookies to the wrong site, and malicious sites being able to set cookies for others. (CVE-2014-3613)
Tim Ruehsen discovered that curl incorrectly allowed cookies to be set for Top Level Domains (TLDs). This could allow a malicious site to set a cookie that gets sent to other sites. (CVE-2014-3620)
- Record
USN-2346-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlDebian:12 |
before 7.38.0-1 | 7.38.0-1 |
curlDebian:13 |
before 7.38.0-1 | 7.38.0-1 |
curlDebian:14 |
before 7.38.0-1 | 7.38.0-1 |
curlDebian:6.0 |
before 7.21.0-2.1+squeeze9, plus listed versions 7.21.0-17.21.0-27.21.0-2.1+squeeze17.21.0-2.1+squeeze27.21.0-2.1+squeeze3 Show 5 moreShow less7.21.0-2.1+squeeze47.21.0-2.1+squeeze57.21.0-2.1+squeeze67.21.0-2.1+squeeze77.21.0-2.1+squeeze8 |
7.21.0-2.1+squeeze9 |
curlDebian:7 |
before 7.26.0-1+wheezy10, plus listed versions 7.26.0-1+wheezy27.26.0-1+wheezy37.26.0-1+wheezy47.26.0-1+wheezy57.26.0-1+wheezy67.26.0-1+wheezy77.26.0-1+wheezy87.26.0-1+wheezy9 |
7.26.0-1+wheezy10 |
curlMageia:3 |
before 7.28.1-6.5.mga3 | 7.28.1-6.5.mga3 |
curlMageia:4 From an advisory covering 2 CVEs |
before 7.34.0-1.3.mga4 | 7.34.0-1.3.mga4 |
curl-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
libcurl-develRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curlRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libcurlRed Hat:enterprise_linux:6::client From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curl-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
libcurl-develRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curlRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
libcurlRed Hat:enterprise_linux:6::computenode From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curlRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curl-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
libcurlRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
libcurl-develRed Hat:enterprise_linux:6::server From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curlRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curl-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
libcurlRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
libcurl-develRed Hat:enterprise_linux:6::workstation From an advisory covering 5 CVEs |
before 0:7.19.7-46.el6 | 0:7.19.7-46.el6 |
curl-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurl-develRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curlRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurlRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curl-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurl-develRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curlRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurlRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curlRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curl-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurlRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurl-develRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curlRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curl-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurlRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
libcurl-develRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-25.el7 | 0:7.29.0-25.el7 |
curlUbuntu:14.04:LTS |
before 7.35.0-1ubuntu2.1, plus listed versions 7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2 |
7.35.0-1ubuntu2.1 |
curlUbuntu:14.04:LTS From an advisory covering 2 CVEs |
before 7.35.0-1ubuntu2.1, plus listed versions 7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2 |
7.35.0-1ubuntu2.1 |
curlopenSUSE:Tumbleweed From an advisory covering 32 CVEs |
before 7.51.0-1.1 | 7.51.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3613 is a medium vulnerability (CVSS 5.0) in Haxx Curl, published September 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.14%, the 94th percentile. Fixed in curl 7.38.0-1.
References
oracle.com/technetwork/topics/security/cpujul2015-2367936.html
curl.haxx.se/docs/adv_20140910A.html
lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
rhn.redhat.com/errata/RHSA-2015-1254.html
Show 94 moreShow less
kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html
securityfocus.com/bid/69748
support.apple.com/kb/HT205031
debian.org/security/2014/dsa-3022
nvd.nist.gov/vuln/detail/CVE-2014-3613
github.com/advisories/GHSA-gcmw-6qh5-324w
security-tracker.debian.org/tracker/CVE-2014-3613
advisories.mageia.org/MGASA-2014-0384.html
bugs.mageia.org/show_bug.cgi?id=14088
access.redhat.com/errata/RHSA-2015:1254
bugzilla.redhat.com/show_bug.cgi?id=835898
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1254.json
cve.org/CVERecord?id=CVE-2014-3613
ubuntu.com/security/CVE-2014-3613
suse.com/security/cve/CVE-2009-0037