{"id":"CVE-2015-3236","aliases":["CURL-CVE-2015-3236","DEBIAN-CVE-2015-3236","EUVD-2015-3292","GHSA-x247-6f29-259j","MGASA-2015-0263","openSUSE-SU-2024:10303-1"],"status":"published","title":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a...","description":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07248,"percentile":0.94377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-06-17T08:00:00Z","modified":"2026-10-24T23:17:46Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.43.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.43.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.43.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.43.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.43.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.43.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.40.0-3.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10131","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://curl.haxx.se/docs/adv_20150617A.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/bid/75385","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/91787","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201509-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3236"},{"url":"https://github.com/advisories/GHSA-x247-6f29-259j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3236","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16140","tags":["report"]},{"url":"http://curl.haxx.se/docs/adv_20150617B.html","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3236","description":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.","status":"published","published":"2015-06-22T19:00:00Z","modified":"2024-08-06T05:39:32.23Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2015-3292","description":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.","status":"published","published":"2015-06-22T19:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-x247-6f29-259j","title":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a...","description":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.","status":"published","published":"2022-05-14T02:21:23Z","modified":"2023-02-02T05:05:41Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:09.721765Z"}],"nvd":[{"id":"CVE-2015-3236","description":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.","status":"published","published":"2015-06-22T19:59:03.683Z","modified":"2026-06-17T00:25:35.703Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"CURL-CVE-2015-3236","title":"lingering HTTP credentials in connection reuse","description":"libcurl can wrongly send HTTP credentials when reusing connections.\n\nlibcurl allows applications to set credentials for the upcoming transfer with\nHTTP Basic authentication, like with `CURLOPT_USERPWD` for example. Name and\npassword. Like all other libcurl options the credentials are sticky and are\nkept associated with the \"handle\" until something is made to change the\nsituation.\n\nFurther, libcurl offers a `curl_easy_reset()` function that resets a handle\nback to its pristine state in terms of all settable options. A reset is of\ncourse also supposed to clear the credentials. A reset is typically used to\nclear up the handle and prepare it for a new, possibly unrelated, transfer.\n\nWithin such a handle, libcurl can also store a set of previous connections in\ncase a second transfer is requested to a hostname for which an existing\nconnection is already kept alive.\n\nWith this flaw present, using the handle even after a reset would make libcurl\naccidentally use those credentials in a subsequent request if done to the same\nhostname and connection as was previously accessed.\n\nAn example case would be first requesting a password protected resource from\none section of a website, and then do a second request of a public resource\nfrom a completely different part of the site without authentication. This flaw\nwould then inadvertently leak the credentials in the second request.","status":"published","published":"2015-06-17T08:00:00Z","modified":"2026-10-24T23:17:46Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2015-3236","description":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.","status":"published","published":"2015-06-22T19:59:03Z","modified":"2026-04-16T06:19:50.380398438Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3236","description":"cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.","status":"published","published":"2015-06-22T19:59:03.683Z","modified":"2026-09-09T06:47:19.926997287Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0263","title":"Updated curl package fixes security vulnerability","description":"libcurl can wrongly send HTTP credentials when re-using connections. Even\nif the handle for an HTTP connection is reset, it retains the credentials,\nwhich can cause them to be unintentionally leaked in subsequent requests\n(CVE-2015-3236).\n\nlibcurl can get tricked by a malicious SMB server to send off data it did\nnot intend to. A malicious SMB server can use this to access arbitrary\nprocess memory, or to crash the client, causing a denial of service\n(CVE-2015-3237).\n","status":"published","published":"2015-07-05T17:22:03Z","modified":"2026-04-16T06:23:45.911162756Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}