{"id":"CVE-2016-9953","aliases":["ALPINE-CVE-2016-9953","BELL-CVE-2016-9953","CURL-CVE-2016-9953","EUVD-2016-10740","GHSA-72rm-6rfp-xgr9"],"status":"published","title":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when...","description":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01797,"percentile":0.78594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2016-12-21T08:00:00Z","modified":"2026-10-25T01:05:37Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"curl","fixed_in":["7.52.1-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.30.0"},{"fixed":"7.52.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.30.0"},{"fixed":"7.52.1-r0"}]}]}],"products":[{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.haxx.se/CVE-2016-9952.patch","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161221C.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9953"},{"url":"https://github.com/advisories/GHSA-72rm-6rfp-xgr9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9953","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-9953","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-9953","description":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.","status":"published","published":"2018-03-12T21:00:00Z","modified":"2024-08-06T03:07:31.231Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-10740","description":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.","status":"published","published":"2018-03-12T21:00:00Z","modified":"2024-08-06T03:07:31Z","updated_at":"2026-11-03T02:22:25.833438Z"}],"ghsa":[{"id":"GHSA-72rm-6rfp-xgr9","title":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when...","description":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.","status":"published","published":"2022-05-14T03:32:35Z","modified":"2023-02-02T05:07:47Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:52:35.379197Z"}],"nvd":[{"id":"CVE-2016-9953","description":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.","status":"published","published":"2018-03-12T21:29:00.563Z","modified":"2026-06-17T00:56:49.663Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"ALPINE-CVE-2016-9953","description":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.","status":"published","published":"2018-03-12T21:29:00.563Z","modified":"2026-09-22T06:17:50.256437171Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2016-9953","title":"CVE-2016-9953 does not affect BellSoft software","status":"withdrawn","published":"2018-03-12T21:29:00Z","modified":"2026-01-26T09:48:07.113519Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-9953","description":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.","status":"published","published":"2018-03-12T21:29:00.563Z","modified":"2026-10-24T10:30:17.447776722Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"CURL-CVE-2016-9953","title":"Win CE Schannel cert name out of buffer read","description":"curl's TLS server certificate checks are flawed on Windows CE.\n\nThis vulnerability occurs in the verify certificate function when comparing a\nwildcard certificate name (as returned by the Windows API function\n`CertGetNameString()` to the hostname used to make the connection to the\nserver.\n\nThe pattern matching logic exhibits an out of bounds read. If the wildcard\ncertificate name field is longer than the connection hostname, the wildcard\ncomparison code performs an access out of bounds of the connection hostname\nheap based buffer. This issue could technically leak the contents of memory\nimmediately preceding the connection hostname buffer, a crash or at worst\nhappen to match against another piece of data.","status":"published","published":"2016-12-21T08:00:00Z","modified":"2026-10-25T01:05:37.7285318Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}