{"id":"CVE-2014-2522","aliases":["CURL-CVE-2014-2522","EUVD-2014-2558","GHSA-wrgp-wm42-6wqv"],"status":"published","title":"curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS...","description":"curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02648,"percentile":0.85716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2014-03-26T08:00:00Z","modified":"2026-10-26T13:07:54Z","products":[{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/57836","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/66296","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/59458","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://seclists.org/oss-sec/2014/q1/586","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://secunia.com/advisories/57968","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://seclists.org/oss-sec/2014/q1/585","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://curl.haxx.se/docs/adv_20140326D.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/57966","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2522"},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release"},{"url":"https://github.com/advisories/GHSA-wrgp-wm42-6wqv"}],"sources":{"cve":[{"id":"CVE-2014-2522","description":"curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2014-04-18T19:00:00Z","modified":"2024-08-06T10:14:26.532Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2558","description":"curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2014-04-18T19:00:00Z","modified":"2024-08-06T10:14:26Z","updated_at":"2026-11-03T01:57:14.00634Z"}],"ghsa":[{"id":"GHSA-wrgp-wm42-6wqv","title":"curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS...","description":"curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2022-05-17T02:47:24Z","modified":"2025-04-12T12:32:50Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:17.411211Z"}],"nvd":[{"id":"CVE-2014-2522","description":"curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2014-04-18T22:14:38.587Z","modified":"2026-06-17T00:06:45.21Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"CURL-CVE-2014-2522","title":"not verifying certs for TLS to IP address / Schannel","description":"When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified\nwith an IP address instead of a name, libcurl would wrongly not verify the\nserver's name in the certificate. The signature (whether it was signed by a\ntrusted CA) and validity (whether the date was within the certificate's\nlifetime and it was not revoked) verification was still performed.\n\nThis is a problem in libcurl built to use the Schannel TLS backend.\nSchannel is the native library provided by Microsoft Windows.\n\nOnly users on Windows can be affected by this, and only if libcurl was built\nto use the native TLS backend library.","status":"published","published":"2014-03-26T08:00:00Z","modified":"2026-10-26T13:07:54.126737817Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}