{"id":"CVE-2015-3153","aliases":["CURL-CVE-2015-3153","DEBIAN-CVE-2015-3153","DSA-3240-1","EUVD-2015-3234","GHSA-hwj5-x3jv-hmff","SUSE-SU-2015:0962-1","SUSE-SU-2015:0990-1","UBUNTU-CVE-2015-3153","USN-2591-1","openSUSE-SU-2024:10303-1"],"status":"published","title":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both...","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07337,"percentile":0.94432,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2014-04-15T15:50:15Z","modified":"2026-10-25T01:04:58Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.42.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.42.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.42.1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"curl","fixed_in":["7.38.0-4+deb8u2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-4+deb8u2"}]}],"versions":["7.38.0-4","7.38.0-4+deb8u1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13","7.35.0-1ubuntu2.20+esm14","7.35.0-1ubuntu2.20+esm15","7.35.0-1ubuntu2.20+esm16","7.35.0-1ubuntu2.20+esm17","7.35.0-1ubuntu2.20+esm18","7.35.0-1ubuntu2.20+esm19","7.35.0-1ubuntu2.20+esm20","7.35.0-1ubuntu2.20+esm21","7.35.0-1ubuntu2.20+esm22","7.35.0-1ubuntu2.20+esm23","7.35.0-1ubuntu2.20+esm24"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"},{"vendor":"oracle","product":"enterprise_manager_ops_center"}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10131","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032233","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.ubuntu.com/usn/USN-2591-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10743","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/74408","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://curl.haxx.se/docs/adv_20150429.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://www.debian.org/security/2015/dsa-3240","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3153"},{"url":"https://github.com/advisories/GHSA-hwj5-x3jv-hmff"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3153","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/824517","tags":["report"]},{"url":"https://bugzilla.suse.com/849596","tags":["report"]},{"url":"https://bugzilla.suse.com/858673","tags":["report"]},{"url":"https://bugzilla.suse.com/868627","tags":["report"]},{"url":"https://bugzilla.suse.com/868629","tags":["report"]},{"url":"https://bugzilla.suse.com/870444","tags":["report"]},{"url":"https://bugzilla.suse.com/927174","tags":["report"]},{"url":"https://bugzilla.suse.com/927556","tags":["report"]},{"url":"https://bugzilla.suse.com/927746","tags":["report"]},{"url":"https://bugzilla.suse.com/928533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/927607","tags":["report"]},{"url":"https://bugzilla.suse.com/927608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3153","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2591-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3148","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","status":"published","published":"2015-05-01T15:00:00Z","modified":"2024-08-06T05:39:31.633Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3234","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","status":"published","published":"2015-05-01T15:00:00Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-hwj5-x3jv-hmff","title":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both...","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","status":"published","published":"2022-05-14T02:21:23Z","modified":"2023-02-02T05:05:39Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:09.236869Z"}],"nvd":[{"id":"CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","status":"published","published":"2015-05-01T15:59:05.817Z","modified":"2026-06-17T00:25:25.76Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CURL-CVE-2015-3153","title":"sensitive HTTP server headers also sent to proxies","description":"libcurl provides applications a way to set custom HTTP headers to be sent to\nthe server by using `CURLOPT_HTTPHEADER`. A similar option is available for\nthe curl command-line tool with the '--header' option.\n\nWhen the connection passes through an HTTP proxy the same set of headers is\nsent to the proxy as well by default. While this is by design, it has not\nnecessarily been clear nor understood by application programmers.\n\nSuch tunneling over a proxy is done for example when using the HTTPS protocol\n- or when explicitly asked for. In this case, the initial connection to the\nproxy is made in clear including any custom headers using the HTTP CONNECT\nmethod.\n\nWhile libcurl provides the `CURLOPT_HEADEROPT` option to allow applications to\ntell libcurl if the headers should be sent to host and the proxy or use\nseparate lists to the different destinations, it has still defaulted to\nsending the same headers to both parties for the sake of compatibility.\n\nIf the application sets a custom HTTP header with sensitive content (e.g.,\nauthentication cookies) without changing the default, the proxy, and anyone\nwho listens to the traffic between the application and the proxy, might get\naccess to those values.\n\nNote: this problem does not exist when using the `CURLOPT_COOKIE` option (or\nthe `--cookie` option) or the HTTP auth options, which are always sent only to\nthe destination server.","status":"published","published":"2015-04-29T08:00:00Z","modified":"2026-10-25T01:04:58.743475848Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","status":"published","published":"2015-05-01T15:59:05Z","modified":"2026-04-10T03:46:17.870428Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","status":"published","published":"2015-05-01T15:59:05.817Z","modified":"2026-09-09T06:47:30.963499892Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3240-1","title":"curl - security update","status":"published","published":"2015-04-29T00:00:00Z","modified":"2026-03-09T01:20:35.921772Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0962-1","title":"Security update for curl","description":"\nThis curl update fixes the following security issues:\n\n    * bnc#868627: wrong re-use of connections (CVE-2014-0138).\n    * bnc#868629: IP address wildcard certificate validation\n      (CVE-2014-0139).\n    * bnc#870444: --insecure option inappropriately enforcing security\n      safeguard.\n\nSecurity Issue references:\n\n    * CVE-2014-0138\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138\u003e\n    * CVE-2014-0139\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139\u003e\n\n","status":"published","published":"2014-04-15T15:50:15Z","modified":"2026-02-04T03:17:15.082145Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0990-1","title":"Security update for curl","description":"curl was updated to fix five security issues.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2015-3143: curl could re-use NTML authenticateds connections\n* CVE-2015-3144: curl could access memory out of bounds with zero length host names\n* CVE-2015-3145: curl cookie parser could access memory out of boundary\n* CVE-2015-3148: curl could treat Negotiate as not connection-oriented\n* CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies\n","status":"published","published":"2015-04-29T18:22:39Z","modified":"2026-02-04T02:50:41.558883Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.","status":"published","published":"2015-04-29T00:00:00Z","modified":"2026-10-17T12:52:53.980937866Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2591-1","title":"curl vulnerabilities","description":"Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP\ncredentials when subsequently connecting to the same host over HTTP.\n(CVE-2015-3143)\n\nHanno Böck discovered that curl incorrectly handled zero-length host names.\nIf a user or automated system were tricked into using a specially crafted\nhost name, an attacker could possibly use this issue to cause curl to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3144)\n\nHanno Böck discovered that curl incorrectly handled cookie path elements.\nIf a user or automated system were tricked into parsing a specially crafted\ncookie, an attacker could possibly use this issue to cause curl to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3145)\n\nIsaac Boukris discovered that when using Negotiate authenticated\nconnections, curl could incorrectly authenticate the entire connection and\nnot just specific HTTP requests. (CVE-2015-3148)\n\nYehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers\nboth to servers and proxies by default, contrary to expectations. This\nissue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3153)\n","status":"published","published":"2015-04-30T13:27:57Z","modified":"2026-04-22T09:11:24.986541Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}