Patrick Monnerat

**Name of the Vulnerable Software and Affected Versions** curl versions prior to 7.88.0 **Description** A flaw in the "chained" HTTP compression algorithms in curl allows a malicious server to insert a virtually unlimited number of compression steps by using many headers, potentially resulting in a denial of service condition due to excessive memory allocation. This could lead to curl spending enormous amounts of allocated heap memory or returning out of memory errors. The issue is related to the decompression chain, where the number of acceptable "links" was capped on a per-header basis, allowing for unlimited compression steps. **Recommendations** For versions prior to 7.88.0, update to version 7.88.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `curl` command with multiple compression algorithms to minimize the risk of exploitation. Avoid using the `curl` command with servers that use multiple headers for compression until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** curl versions 7.33.0 through 7.82.0 **Description** An improper authentication issue exists, potentially allowing the reuse of OAUTH2-authenticated connections without ensuring the connection was authenticated with the same credentials as set for the transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S), and LDAP(S) (openldap only). The issue is related to how libcurl maintains a pool of live connections after a transfer has completed, which can lead to an authentication bypass if a connection is reused with different credentials. **Recommendations** For curl versions 7.33.0 through 7.82.0, consider disabling the reuse of OAUTH2-authenticated connections as a temporary workaround until a patch is available. Restrict access to SASL-enabled protocols to minimize the risk of exploitation. Avoid reusing connections authenticated with OAUTH2 bearers for different users or credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.