{"id":"CVE-2015-3144","aliases":["CURL-CVE-2015-3144","DEBIAN-CVE-2015-3144","EUVD-2015-3225","GHSA-w3rm-phr3-x8q8","SUSE-SU-2015:0990-1","UBUNTU-CVE-2015-3144","USN-2591-1","openSUSE-SU-2024:10303-1"],"status":"published","title":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate...","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","severity":{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.10533,"percentile":0.95801,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-04-22T00:00:00Z","modified":"2026-10-25T01:04:57Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"},{"vendor":"oracle","product":"mysql_enterprise_monitor"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3232","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/74300","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2591-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1032232","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10743","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201509-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150422D.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3144"},{"url":"https://github.com/advisories/GHSA-w3rm-phr3-x8q8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3144","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/927556","tags":["report"]},{"url":"https://bugzilla.suse.com/927607","tags":["report"]},{"url":"https://bugzilla.suse.com/927608","tags":["report"]},{"url":"https://bugzilla.suse.com/927746","tags":["report"]},{"url":"https://bugzilla.suse.com/928533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3144","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2591-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3153","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3144","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","status":"published","published":"2015-04-24T14:00:00Z","modified":"2024-08-06T05:39:31.551Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3225","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","status":"published","published":"2015-04-24T14:00:00Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-w3rm-phr3-x8q8","title":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate...","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","status":"published","published":"2022-05-14T02:21:23Z","modified":"2023-02-02T05:06:00Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:13.176189Z"}],"nvd":[{"id":"CVE-2015-3144","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","status":"published","published":"2015-04-24T14:59:09.203Z","modified":"2026-06-17T00:25:23.067Z","cvss":[{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CURL-CVE-2015-3144","title":"hostname out of boundary memory access","description":"There is a private function in libcurl called `fix_hostname()` that removes a\ntrailing dot from the hostname if there is one. The function is called after\nthe hostname has been extracted from the URL libcurl has been told to act on.\n\nIf a URL is given with a zero-length hostname, like in \"http://:80\" or \":80\",\n`fix_hostname()` indexes the hostname pointer with a -1 offset (as it blindly\nassumes a non-zero length) and both read and assign that address.\n\nAt best, this gets unnoticed but can also lead to a crash or worse. We have\nnot researched further what kind of malicious actions that potentially this\ncould be used for.","status":"published","published":"2015-04-22T08:00:00Z","modified":"2026-10-25T01:04:57.975963216Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2015-3144","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","status":"published","published":"2015-04-24T14:59:09Z","modified":"2026-04-10T03:46:17.747617Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3144","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","status":"published","published":"2015-04-24T14:59:09.203Z","modified":"2026-09-09T06:47:27.75844822Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0990-1","title":"Security update for curl","description":"curl was updated to fix five security issues.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2015-3143: curl could re-use NTML authenticateds connections\n* CVE-2015-3144: curl could access memory out of bounds with zero length host names\n* CVE-2015-3145: curl cookie parser could access memory out of boundary\n* CVE-2015-3148: curl could treat Negotiate as not connection-oriented\n* CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies\n","status":"published","published":"2015-04-29T18:22:39Z","modified":"2026-02-04T02:50:41.558883Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-3144","description":"The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by \"http://:80\" and \":80.\"","status":"withdrawn","published":"2015-04-22T00:00:00Z","modified":"2026-02-04T03:23:09.404977Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2591-1","title":"curl vulnerabilities","description":"Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP\ncredentials when subsequently connecting to the same host over HTTP.\n(CVE-2015-3143)\n\nHanno Böck discovered that curl incorrectly handled zero-length host names.\nIf a user or automated system were tricked into using a specially crafted\nhost name, an attacker could possibly use this issue to cause curl to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3144)\n\nHanno Böck discovered that curl incorrectly handled cookie path elements.\nIf a user or automated system were tricked into parsing a specially crafted\ncookie, an attacker could possibly use this issue to cause curl to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3145)\n\nIsaac Boukris discovered that when using Negotiate authenticated\nconnections, curl could incorrectly authenticate the entire connection and\nnot just specific HTTP requests. (CVE-2015-3148)\n\nYehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers\nboth to servers and proxies by default, contrary to expectations. This\nissue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3153)\n","status":"published","published":"2015-04-30T13:27:57Z","modified":"2026-04-22T09:11:24.986541Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}