{"id":"CVE-2020-8231","aliases":["ALPINE-CVE-2020-8231","BELL-CVE-2020-8231","CURL-CVE-2020-8231","DEBIAN-CVE-2020-8231","DLA-2382-1","DSA-4881-1","EUVD-2020-29103","GHSA-xp52-49j5-h754","JLSEC-2025-23","MGASA-2020-0482","OESA-2021-1004","RHSA-2021:1610","RLSA-2021:1610","SUSE-SU-2020:14481-1","SUSE-SU-2020:2444-1","SUSE-SU-2020:2445-1","SUSE-SU-2020:2446-1","SUSE-SU-2021:1786-1","UBUNTU-CVE-2020-8231","USN-4466-1","USN-4466-2","USN-4665-1","openSUSE-SU-2020:1345-1","openSUSE-SU-2020:1359-1","openSUSE-SU-2020:1494-1","openSUSE-SU-2024:10582-1"],"status":"published","title":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when...","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05344,"percentile":0.92686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2020-08-19T00:00:00Z","modified":"2026-11-04T02:30:16Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.66.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.67.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.69.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.72.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"curl","fixed_in":["7.66.0-r5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.72.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.72.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.72.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"curl","fixed_in":["7.52.1-5+deb9u12"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.81.0+0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","fixed_in":["7.37.0-70.52.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","fixed_in":["7.60.0-11.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","fixed_in":["7.60.0-11.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","fixed_in":["7.60.0-11.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","fixed_in":["7.66.0-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"curl","fixed_in":["7.60.0-3.32.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"curl","fixed_in":["7.60.0-lp151.5.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"curl-mini","fixed_in":["7.60.0-lp151.5.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"curl","fixed_in":["7.66.0-lp152.3.6.1","7.66.0-lp152.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","fixed_in":["7.66.0-lp152.3.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.67.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.69.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-r5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-5+deb9u12"}]}],"versions":["7.52.1-5","7.52.1-5+deb9u1","7.52.1-5+deb9u10","7.52.1-5+deb9u11","7.52.1-5+deb9u2","7.52.1-5+deb9u3","7.52.1-5+deb9u4","7.52.1-5+deb9u5","7.52.1-5+deb9u6","7.52.1-5+deb9u7","7.52.1-5+deb9u8","7.52.1-5+deb9u9"]},{"source":"osv","ecosystem":"Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u2"}]}],"versions":["7.64.0-4","7.64.0-4+deb10u1"],"bundled":8},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.81.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.0-1.1.mga7"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-4.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-4.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-18.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.52.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.16"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.10"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.2"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.16"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.10"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.2"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.18"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.12"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.4"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-lp151.5.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-lp151.5.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1.1"}]}],"bundled":48}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"libcurl"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/948876","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://curl.haxx.se/docs/CVE-2020-8231.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202012-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-4881","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8231","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-xp52-49j5-h754"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8231","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8231","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8231","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0482.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27154","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4466-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Q7JHSXTQ7EUHJPYL333CB3OBCKHA5FQC/","tags":["web"]},{"url":"https://curl.se/docs/CVE-2020-8284.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2020-8285.html","tags":["advisory","article"]},{"url":"https://curl.se/docs/CVE-2020-8286.html","tags":["advisory","article"]},{"url":"https://ubuntu.com/security/notices/USN-4665-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8284","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1610","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1873327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918692","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1610.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8231","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8231","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8284","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8285","tags":["advisory"]},{"url":"https://github.com/curl/curl/issues/6255","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8286","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8286","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1610","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014481-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175109","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8231","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202444-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202445-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202446-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211786-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177976","tags":["report"]},{"url":"https://bugzilla.suse.com/1179398","tags":["report"]},{"url":"https://bugzilla.suse.com/1179399","tags":["report"]},{"url":"https://bugzilla.suse.com/1179593","tags":["report"]},{"url":"https://bugzilla.suse.com/1183933","tags":["report"]},{"url":"https://bugzilla.suse.com/1186114","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22898","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-8231","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4466-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8286","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4GYMJ253P5P56DA4D52GJARISIK23N3Z/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OYNSNHOY2FLBCRE3LL6P6WDS2PP7SJDE/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M6RLFHLNRH5DNEKWRVFQA5NSKVRZEQHR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22947","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2020-12-14T19:39:19Z","modified":"2026-11-02T17:57:06.989Z","cwes":["CWE-416"],"updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2020-29103","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2020-12-14T19:39:19Z","modified":"2026-11-02T17:57:06Z","updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-xp52-49j5-h754","title":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when...","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2022-05-24T17:36:22Z","modified":"2026-10-14T09:31:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2020-12-14T20:15:13.59Z","modified":"2026-11-02T18:18:30.187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"ALPINE-CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2020-12-14T20:15:13.59Z","modified":"2026-10-26T11:17:55.18312408Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-8231","title":"CVE-2020-8231 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:25.120352Z","modified":"2026-01-26T09:49:15.137683Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2020-12-14T20:15:13.59Z","modified":"2026-11-04T02:30:16.321529535Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"DEBIAN-CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2020-12-14T20:15:13.59Z","modified":"2026-11-03T09:47:29.384283248Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"JLSEC-2025-23","title":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when...","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2025-10-10T15:04:01.319Z","modified":"2026-07-23T22:30:21.309242242Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2021-1004","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\\r\\n\\r\\n\r\nSecurity Fix(es):\\r\\n\\r\\n\r\nDue to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.(CVE-2020-8231)\\r\\n\\r\\n\r\ncurl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.(CVE-2020-8286)\\r\\n\\r\\n\r\ncurl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.(CVE-2020-8285)\\r\\n\\r\\n\nA malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.(CVE-2020-8284)\\r\\n\\r\\n","status":"published","published":"2021-02-04T11:04:13Z","modified":"2026-08-18T01:15:04.645621775Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:1610","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T04:59:29Z","modified":"2026-10-15T10:01:48Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1610","title":"Moderate: curl security and bug fix update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: FTP PASV command response can cause curl to connect to arbitrary host (CVE-2020-8284)\n\n* curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285)\n\n* curl: Inferior OCSP verification (CVE-2020-8286)\n\n* curl: Expired pointer dereference via multi API with CURLOPT_CONNECT_ONLY option set (CVE-2020-8231)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T05:39:00Z","modified":"2026-02-05T12:15:06.28717Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.","status":"published","published":"2020-08-19T00:00:00Z","modified":"2026-04-22T12:43:48.153568Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"CURL-CVE-2020-8231","title":"wrong connect-only connection","description":"An application that performs multiple requests with libcurl's multi API and\nsets the `CURLOPT_CONNECT_ONLY` option, might in rare circumstances experience\nthat when subsequently using the setup connect-only transfer, libcurl picks\nand uses the wrong connection - and instead picks another one the application\nhas created since then.\n\n`CURLOPT_CONNECT_ONLY` is the option to tell libcurl to not perform an actual\ntransfer, only connect. When that operation is completed, libcurl remembers\nwhich connection it used for that transfer and \"easy handle\". It remembers the\nconnection using a pointer to the internal `connectdata` struct in memory.\n\nIf more transfers are then done with the same multi handle before the\nconnect-only connection is used, leading to the initial connect-only\nconnection to get closed (for example due to idle time-out) while also new\ntransfers (and connections) are setup, such a *new* connection might end up\ngetting the exact same memory address as the now closed connect-only\nconnection.\n\nIf after those operations, the application then wants to use the original\ntransfer's connect-only setup to for example use `curl_easy_send()` to send\nraw data over that connection, libcurl could **erroneously** find an existing\nconnection still being alive at the address it remembered since before even\nthough this is now a new and different connection.\n\nThe application could then accidentally send data over that connection which\nwas not at all intended for that recipient, entirely unknowingly.","status":"published","published":"2020-08-19T08:00:00Z","modified":"2026-10-25T01:05:11.755917217Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-2382-1","title":"curl - security update","status":"published","published":"2020-09-26T00:00:00Z","modified":"2026-03-09T01:23:32.273173Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4881-1","title":"curl - security update","status":"published","published":"2021-03-30T00:00:00Z","modified":"2026-03-09T02:10:40.275019Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0482","title":"Updated curl packages fix security vulnerabilities","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the\nwrong connection when sending data. (CVE-2020-8231).\n\nA malicious server can use the FTP PASV response to trick curl 7.73.0 and\nearlier into connecting back to a given IP address and port, and this way\npotentially make curl extract information about services that are otherwise\nprivate and not disclosed, for example doing port scanning and service banner\nextractions. (CVE-2020-8284).\n\ncurl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion\ndue to a stack overflow issue in FTP wildcard match parsing. (CVE-2020-8285).\n\ncurl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate\nrevocation due to insufficient verification of the OCSP response.\n(CVE-2020-8286).\n","status":"published","published":"2020-12-31T14:32:44Z","modified":"2026-04-16T04:43:39.564242Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1345-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- An application that performs multiple requests with libcurl's\n  multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in\n  rare circumstances experience that when subsequently using the\n  setup connect-only transfer, libcurl will pick and use the wrong\n  connection and instead pick another one the application has\n  created since then. [bsc#1175109, CVE-2020-8231]\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-09-05T12:23:28Z","modified":"2026-02-04T02:34:56.361544Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1359-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- An application that performs multiple requests with libcurl's\n  multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in\n  rare circumstances experience that when subsequently using the\n  setup connect-only transfer, libcurl will pick and use the wrong\n  connection and instead pick another one the application has\n  created since then. [bsc#1175109, CVE-2020-8231]\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-09-07T08:27:50Z","modified":"2026-02-04T03:27:44.077626Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1494-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- An application that performs multiple requests with libcurl's\n  multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in\n  rare circumstances experience that when subsequently using the\n  setup connect-only transfer, libcurl will pick and use the wrong\n  connection and instead pick another one the application has\n  created since then. [bsc#1175109, CVE-2020-8231]\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-09-21T10:30:47Z","modified":"2026-02-04T03:32:13.651918Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10582-1","title":"curl-7.79.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:36.472951Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:14481-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- An application that performs multiple requests with libcurl's\n  multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in\n  rare circumstances experience that when subsequently using the\n  setup connect-only transfer, libcurl will pick and use the wrong\n  connection and instead pick another one the application has\n  created since then. [bsc#1175109, CVE-2020-8231]\n","status":"published","published":"2020-09-02T12:00:19Z","modified":"2026-02-04T03:39:14.176429Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2444-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- An application that performs multiple requests with libcurl's\n  multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in\n  rare circumstances experience that when subsequently using the\n  setup connect-only transfer, libcurl will pick and use the wrong\n  connection and instead pick another one the application has\n  created since then. [bsc#1175109, CVE-2020-8231]\n","status":"published","published":"2020-09-02T07:32:50Z","modified":"2026-02-04T04:24:25.166734Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2445-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- An application that performs multiple requests with libcurl's\n  multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in\n  rare circumstances experience that when subsequently using the\n  setup connect-only transfer, libcurl will pick and use the wrong\n  connection and instead pick another one the application has\n  created since then. [bsc#1175109, CVE-2020-8231]\n","status":"published","published":"2020-09-02T07:33:06Z","modified":"2026-02-04T04:18:05.402376Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2446-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- An application that performs multiple requests with libcurl's\n  multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in\n  rare circumstances experience that when subsequently using the\n  setup connect-only transfer, libcurl will pick and use the wrong\n  connection and instead pick another one the application has\n  created since then. [bsc#1175109, CVE-2020-8231]\n","status":"published","published":"2020-09-02T07:33:26Z","modified":"2026-02-04T02:53:34.290378Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2021:1786-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n- CVE-2021-22898: TELNET stack contents disclosure (bsc#1186114)\n- CVE-2021-22876: The automatic referer leaks credentials (bsc#1183933)\n- CVE-2020-8286: Inferior OCSP verification (bsc#1179593)\n- CVE-2020-8285: FTP wildcard stack overflow (bsc#1179399)\n- CVE-2020-8284: Trusting FTP PASV responses (bsc#1179398)\n- CVE-2020-8231: libcurl will pick and use the wrong connection with multiple requests with libcurl's multi API and the 'CURLOPT_CONNECT_ONLY' option (bsc#1175109)\n- Fix: SFTP uploads result in empty uploaded files (bsc#1177976)\n","status":"published","published":"2021-05-27T14:45:51Z","modified":"2026-02-04T04:18:37.030331Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4466-1","title":"curl vulnerability","description":"Marc Aldorasi discovered that curl incorrectly handled the libcurl\nCURLOPT_CONNECT_ONLY option. This could result in data being sent to the\nwrong destination, possibly exposing sensitive information.\n","status":"published","published":"2020-08-19T11:33:56Z","modified":"2026-04-22T10:06:21.948338Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4466-2","title":"curl vulnerability","description":"USN-4466-1 fixed a vulnerability in curl. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Marc Aldorasi discovered that curl incorrectly handled the libcurl\n CURLOPT_CONNECT_ONLY option. This could result in data being sent to the\n wrong destination, possibly exposing sensitive information.\n","status":"published","published":"2020-08-20T12:25:28Z","modified":"2026-04-22T10:06:36.183572Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4665-1","title":"curl vulnerabilities","description":"Marc Aldorasi discovered that curl incorrectly handled the libcurl\nCURLOPT_CONNECT_ONLY option. This could result in data being sent to the\nwrong destination, possibly exposing sensitive information. This issue only\naffected Ubuntu 20.10. (CVE-2020-8231)\n\nVarnavas Papaioannou discovered that curl incorrectly handled FTP PASV\nresponses. An attacker could possibly use this issue to trick curl into\nconnecting to an arbitrary IP address and be used to perform port scanner\nand other information gathering. (CVE-2020-8284)\n\nIt was discovered that curl incorrectly handled FTP wildcard matchins. A\nremote attacker could possibly use this issue to cause curl to consume\nresources and crash, resulting in a denial of service. (CVE-2020-8285)\n\nIt was discovered that curl incorrectly handled OCSP response verification.\nA remote attacker could possibly use this issue to provide a fraudulent\nOCSP response. (CVE-2020-8286)\n","status":"published","published":"2020-12-09T12:10:47Z","modified":"2026-04-27T09:16:46.981618Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}