{"id":"CVE-2010-0734","aliases":["CURL-CVE-2010-0734","DEBIAN-CVE-2010-0734","DSA-2023-1","EUVD-2010-0760","GHSA-65fc-r6mj-6v9j","RHSA-2010:0273","RHSA-2010:0329"],"status":"published","title":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly...","description":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03643,"percentile":0.89644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2010-02-09T08:00:00Z","modified":"2026-10-24T23:29:53Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.20.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.20.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.20.0-1"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"curl","fixed_in":["7.18.2-8lenny4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-debuginfo","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-devel","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl-debuginfo","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-debuginfo","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-devel","fixed_in":["0:7.15.5-9.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-debuginfo","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-devel","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-debuginfo","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-devel","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-debuginfo","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-devel","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-debuginfo","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-devel","fixed_in":["0:7.10.6-11.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.20.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.20.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.20.0-1"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.18.2-8lenny4"}]}],"versions":["7.18.2-8","7.18.2-8lenny2","7.18.2-8lenny3"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-9.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-11.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.3"}]}]}],"products":[{"vendor":"curl","product":"libcurl"}],"references":[{"url":"http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2010/0571","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0602","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/archive/1/514490/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://secunia.com/advisories/38843","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2010/03/09/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"http://secunia.com/advisories/38981","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/1481","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1158-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://curl.haxx.se/docs/adv_20100209.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0725","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2010/dsa-2023","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0329.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10760","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://support.apple.com/kb/HT4188","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=563220","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:062","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/40220","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-201203-02.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037143.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036744.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/48256","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://support.avaya.com/css/P8/documents/100081819","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2010/03/16/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"http://secunia.com/advisories/39087","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2011-0003.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/45047","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2010-0072","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://curl.haxx.se/libcurl-contentencoding.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/archive/1/516397/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6756","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://secunia.com/advisories/39734","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://curl.haxx.se/docs/security.html#20100209","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0660","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2010/02/09/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-0734","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-65fc-r6mj-6v9j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-0734","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0273","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=479967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=517084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=517199","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0273.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-0734","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-0734","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0329","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0329.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-0734","description":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","status":"published","published":"2010-03-19T19:00:00Z","modified":"2024-08-07T00:59:39.012Z","updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2010-0760","description":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","status":"published","published":"2010-03-19T19:00:00Z","modified":"2024-08-07T00:59:39Z","updated_at":"2026-11-03T01:39:44.13762Z"}],"ghsa":[{"id":"GHSA-65fc-r6mj-6v9j","title":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly...","description":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","status":"published","published":"2022-05-02T06:15:13Z","modified":"2023-02-01T05:00:39Z","updated_at":"2026-11-02T14:49:34.37252Z"}],"nvd":[{"id":"CVE-2010-0734","description":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","status":"published","published":"2010-03-19T19:30:00.577Z","modified":"2026-06-16T23:16:44.653Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:43.639743Z"}],"osv":[{"id":"CURL-CVE-2010-0734","title":"data callback excessive length","description":"When downloading data, libcurl hands it over to the application using a\ncallback that is registered by the client software. libcurl then calls that\nfunction repeatedly with data until the transfer is complete. The callback is\ndocumented to receive a maximum data size of 16K (`CURL_MAX_WRITE_SIZE`).\n\nUsing the affected libcurl version to download compressed content over HTTP,\nan application can ask libcurl to automatically uncompress data. When doing\nso, libcurl can wrongly send data up to 64K in size to the callback which\nthus is much larger than the documented maximum size. An application that\nblindly trusts libcurl's max limit for a fixed buffer size or similar is\nthen a possible target for a buffer overflow vulnerability.\n\nThis error is only present in zlib-enabled builds of libcurl and only if\nautomatic decompression has been explicitly enabled by the application - it\nis disabled by default.\n\nWe have not found any libcurl client software that is vulnerable to this\nflaw - but we acknowledge that there may still be vulnerable software in\nexistence.","status":"published","published":"2010-02-09T08:00:00Z","modified":"2026-10-24T23:29:53Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2010-0734","description":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","status":"published","published":"2010-03-19T19:30:00Z","modified":"2026-04-10T03:41:09.722168Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2010-0734","description":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","status":"published","published":"2010-03-19T19:30:00.577Z","modified":"2026-10-23T17:47:26.126512671Z","updated_at":"2026-11-02T15:45:24.316685Z"},{"id":"DSA-2023-1","title":"curl - arbitrary code execution","status":"published","published":"2010-03-28T00:00:00Z","modified":"2026-03-09T01:21:27.08639Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"RHSA-2010:0273","title":"Red Hat Security Advisory: curl security, bug fix and enhancement update","status":"published","published":"2024-09-15T18:13:16Z","modified":"2026-06-26T12:20:32.112481244Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2010:0329","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-15T18:13:21Z","modified":"2026-06-26T10:13:20Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}