PT-2016-7528 · Curl+3 · Libcurl+3
Andrej Nemec
·
Published
2016-11-02
·
Updated
2026-05-18
·
CVE-2016-8622
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libcurl versions prior to 7.51.0
Description
The issue concerns the URL percent-encoding decode function in libcurl, internally known as
curl easy unescape. This function can lead to libcurl writing outside of its heap-based buffer if it attempts to allocate a destination buffer larger than 2GB, due to the length being returned in a signed 32-bit integer variable. This can cause the length to be truncated or become negative. The problem can be triggered by a user on a 64-bit system if they can send a custom, very large URL to a libcurl-using program.Recommendations
For versions prior to 7.51.0, update to version 7.51.0 or later to resolve the issue. As a temporary workaround, consider restricting the size of URLs that can be processed by libcurl to prevent the
curl easy unescape function from attempting to allocate excessively large buffers.Fix
Heap Based Buffer Overflow
Integer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Suse
Ubuntu
Libcurl