Haxx Curl 7.50.0

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:haxx:curl:7.50.0:*:*:*:*:*:*:*

part: a version: 7.50.0 update: *

VendorHaxx (d671a1c6-5c93-5e0c-94d0-7f7092cb4b41)
ProductCurl (2d1ca0dd-2ad5-581e-9bc3-c802b3d3d143)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/curl purl2cpe 2026-06-01 10:12:19.109398
pkg:deb/ubuntu/curl purl2cpe 2026-06-01 10:12:19.109399
pkg:github/curl/curl purl2cpe 2026-06-01 10:12:19.109401
pkg:rpm/fedora/curl purl2cpe 2026-06-01 10:12:19.109402
pkg:rpm/opensuse/curl purl2cpe 2026-06-01 10:12:19.109404

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-1000101 vulnerable 2026-06-08 05:08:33.988707 Details available
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
Published: 2017-10-04T01:00:00.000Z
Updated: 2026-04-16T13:45:37.458Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.