{"id":"CVE-2016-9594","aliases":["ALPINE-CVE-2016-9594","BELL-CVE-2016-9594","CURL-CVE-2016-9594","EUVD-2016-10398","GHSA-qq6c-xrmh-q72x","openSUSE-SU-2024:10582-1"],"status":"published","title":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal...","description":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02218,"percentile":0.8277,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-665"],"published":"2016-12-23T08:00:00Z","modified":"2026-10-25T01:04:56Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.52.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.2","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"curl","fixed_in":["7.52.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"curl","fixed_in":["7.52.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"curl","fixed_in":["7.52.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1.1"}]}],"bundled":48}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"},{"vendor":"unspecified","product":"curl"}],"references":[{"url":"http://www.securityfocus.com/bid/95094","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161223.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2017-04","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1037528","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-47","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9594","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9594"},{"url":"https://github.com/advisories/GHSA-qq6c-xrmh-q72x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9594","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-9594","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22947","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9594","description":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.","status":"published","published":"2018-04-23T19:00:00Z","modified":"2026-04-15T21:03:18.894Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10398","description":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.","status":"published","published":"2018-04-23T19:00:00Z","modified":"2026-04-15T21:03:18Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:24.796113Z"}],"ghsa":[{"id":"GHSA-qq6c-xrmh-q72x","title":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal...","description":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.","status":"published","published":"2022-05-13T01:38:28Z","modified":"2023-02-01T05:08:57Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:50:53.78471Z"}],"nvd":[{"id":"CVE-2016-9594","description":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.","status":"published","published":"2018-04-23T19:29:00.233Z","modified":"2026-06-17T00:56:18.483Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"ALPINE-CVE-2016-9594","description":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.","status":"published","published":"2018-04-23T19:29:00.233Z","modified":"2026-09-22T06:17:50.253147853Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2016-9594","title":"CVE-2016-9594 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:24.94531Z","modified":"2026-01-26T09:46:53.316095Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-9594","description":"curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.","status":"published","published":"2018-04-23T19:29:00.233Z","modified":"2026-10-24T10:30:51.797776866Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"CURL-CVE-2016-9594","title":"uninitialized random","description":"libcurl's (new) internal function that returns a good 32-bit random value was\nimplemented poorly and overwrote the pointer instead of writing the value into\nthe buffer the pointer pointed to.\n\nThis random value is used to generate nonces for Digest and NTLM\nauthentication, for generating boundary strings in HTTP formposts and\nmore. Having a weak or virtually non-existent random there makes these\noperations vulnerable.\n\nThis function is brand new in 7.52.0 and is the result of an overhaul to make\nsure libcurl uses strong random as much as possible - provided by the backend\nTLS crypto libraries when present.","status":"published","published":"2016-12-23T08:00:00Z","modified":"2026-10-25T01:04:56.788540118Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"openSUSE-SU-2024:10582-1","title":"curl-7.79.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:36.472951Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}