TI-2016-03971 Aliases CVE-2016-4606 GHSA-2fx2-v8hh-86v7

Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or…

MEDIUM 48Published 2020-02-21 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.

Why it matters now

EPSS 0.03402 88th percentileScored 2026-11-07

Fix Fixed curl: 7.49.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	curl	before 7.49.1	7.49.1	Patch available	CNA

curl Vendor— Affected before 7.49.1 Fixed in 7.49.1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:curl::::::::	before 7.49.1	Vulnerable	Haxx
cpe:2.3:o:apple:mac_os_x::::::::	before 10.12.0	Running on	Apple

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions before 7.49.1 Vulnerable ·Haxx
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions before 10.12.0 Running on ·Apple

Remediation

Fix · CNA curl Fixed in 7.49.1

Timeline

2026-10-02 Threatist record created from CVE-2016-4606
2026-10-03 Alias added: GHSA-2fx2-v8hh-86v7

References

Advisory 1

https://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html

TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
TI-2026-10231 cross-origin Digest auth state leak CVSS 3.1CRITICAL 9.8
TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8
TI-2023-12257 Injection in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8

See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences