Read the docs
TI-2017-14437 Aliases CVE-2017-1000100GHSA-86r8-52rx-6jcr

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file…

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 7 fixed, 10 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03958 90th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 7 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 79

CPEVersionsRoleVendor
cpe:2.3:a:haxx:libcurl:7.15.0:*:*:*:*:*:*:*7.15.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.15.1:*:*:*:*:*:*:*7.15.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.15.2:*:*:*:*:*:*:*7.15.2VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.15.3:*:*:*:*:*:*:*7.15.3VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.15.4:*:*:*:*:*:*:*7.15.4VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.15.5:*:*:*:*:*:*:*7.15.5VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.16.0:*:*:*:*:*:*:*7.16.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.16.1:*:*:*:*:*:*:*7.16.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.16.2:*:*:*:*:*:*:*7.16.2VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.16.3:*:*:*:*:*:*:*7.16.3VulnerableHaxx
  • cpe:2.3:a:haxx:libcurl:7.15.0:*:*:*:*:*:*:* Versions 7.15.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.15.1:*:*:*:*:*:*:* Versions 7.15.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.15.2:*:*:*:*:*:*:* Versions 7.15.2 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.15.3:*:*:*:*:*:*:* Versions 7.15.3 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.15.4:*:*:*:*:*:*:* Versions 7.15.4 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.15.5:*:*:*:*:*:*:* Versions 7.15.5 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.16.0:*:*:*:*:*:*:* Versions 7.16.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.16.1:*:*:*:*:*:*:* Versions 7.16.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.16.2:*:*:*:*:*:*:* Versions 7.16.2 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.16.3:*:*:*:*:*:*:* Versions 7.16.3 Vulnerable ·Haxx
Show 69 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:haxx:libcurl:7.16.4:*:*:*:*:*:*:*7.16.4VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.17.0:*:*:*:*:*:*:*7.17.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:*7.17.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*7.18.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*7.18.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*7.18.2VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*7.19.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*7.19.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*7.19.2VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*7.19.3VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*7.19.4VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*7.19.5VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*7.19.6VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*7.19.7VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*7.20.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*7.20.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*7.21.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*7.21.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*7.21.2VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*7.21.3VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*7.21.4VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*7.21.5VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*7.21.6VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*7.21.7VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*7.22.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*7.23.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*7.23.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*7.24.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*7.25.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*7.26.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*7.27.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*7.28.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*7.28.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*7.29.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*7.30.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*7.31.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*7.32.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*7.33.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*7.34.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*7.35.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*7.36.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*7.37.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*7.37.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*7.38.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:*7.39VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:*7.40.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:*7.41.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.42.0:*:*:*:*:*:*:*7.42.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.42.1:*:*:*:*:*:*:*7.42.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.43.0:*:*:*:*:*:*:*7.43.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.44.0:*:*:*:*:*:*:*7.44.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.45.0:*:*:*:*:*:*:*7.45.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.46.0:*:*:*:*:*:*:*7.46.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.47.0:*:*:*:*:*:*:*7.47.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.47.1:*:*:*:*:*:*:*7.47.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.48.0:*:*:*:*:*:*:*7.48.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.49.0:*:*:*:*:*:*:*7.49.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.49.1:*:*:*:*:*:*:*7.49.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.50.0:*:*:*:*:*:*:*7.50.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.50.1:*:*:*:*:*:*:*7.50.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.50.2:*:*:*:*:*:*:*7.50.2VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.50.3:*:*:*:*:*:*:*7.50.3VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.51.0:*:*:*:*:*:*:*7.51.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.52.0:*:*:*:*:*:*:*7.52.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.52.1:*:*:*:*:*:*:*7.52.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.53.0:*:*:*:*:*:*:*7.53.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.53.1:*:*:*:*:*:*:*7.53.1VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.54.0:*:*:*:*:*:*:*7.54.0VulnerableHaxx
cpe:2.3:a:haxx:libcurl:7.54.1:*:*:*:*:*:*:*7.54.1VulnerableHaxx
  • cpe:2.3:a:haxx:libcurl:7.16.4:*:*:*:*:*:*:* Versions 7.16.4 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.17.0:*:*:*:*:*:*:* Versions 7.17.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:* Versions 7.17.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:* Versions 7.18.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:* Versions 7.18.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:* Versions 7.18.2 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:* Versions 7.19.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:* Versions 7.19.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:* Versions 7.19.2 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:* Versions 7.19.3 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:* Versions 7.19.4 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:* Versions 7.19.5 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:* Versions 7.19.6 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:* Versions 7.19.7 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:* Versions 7.20.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:* Versions 7.20.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:* Versions 7.21.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:* Versions 7.21.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:* Versions 7.21.2 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:* Versions 7.21.3 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:* Versions 7.21.4 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:* Versions 7.21.5 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:* Versions 7.21.6 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:* Versions 7.21.7 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:* Versions 7.22.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:* Versions 7.23.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:* Versions 7.23.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:* Versions 7.24.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:* Versions 7.25.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:* Versions 7.26.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:* Versions 7.27.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:* Versions 7.28.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:* Versions 7.28.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:* Versions 7.29.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:* Versions 7.30.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:* Versions 7.31.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:* Versions 7.32.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:* Versions 7.33.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:* Versions 7.34.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:* Versions 7.35.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:* Versions 7.36.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:* Versions 7.37.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:* Versions 7.37.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:* Versions 7.38.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:* Versions 7.39 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:* Versions 7.40.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:* Versions 7.41.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.42.0:*:*:*:*:*:*:* Versions 7.42.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.42.1:*:*:*:*:*:*:* Versions 7.42.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.43.0:*:*:*:*:*:*:* Versions 7.43.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.44.0:*:*:*:*:*:*:* Versions 7.44.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.45.0:*:*:*:*:*:*:* Versions 7.45.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.46.0:*:*:*:*:*:*:* Versions 7.46.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.47.0:*:*:*:*:*:*:* Versions 7.47.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.47.1:*:*:*:*:*:*:* Versions 7.47.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.48.0:*:*:*:*:*:*:* Versions 7.48.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.49.0:*:*:*:*:*:*:* Versions 7.49.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.49.1:*:*:*:*:*:*:* Versions 7.49.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.50.0:*:*:*:*:*:*:* Versions 7.50.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.50.1:*:*:*:*:*:*:* Versions 7.50.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.50.2:*:*:*:*:*:*:* Versions 7.50.2 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.50.3:*:*:*:*:*:*:* Versions 7.50.3 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.51.0:*:*:*:*:*:*:* Versions 7.51.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.52.0:*:*:*:*:*:*:* Versions 7.52.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.52.1:*:*:*:*:*:*:* Versions 7.52.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.53.0:*:*:*:*:*:*:* Versions 7.53.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.53.1:*:*:*:*:*:*:* Versions 7.53.1 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.54.0:*:*:*:*:*:*:* Versions 7.54.0 Vulnerable ·Haxx
  • cpe:2.3:a:haxx:libcurl:7.54.1:*:*:*:*:*:*:* Versions 7.54.1 Vulnerable ·Haxx

Remediation

Red Hat 1 advisory

  • RHSA-2018:3558 Released 2018-11-13 · Red Hat rating Moderate
    httpd24 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-curl-7.61.1-1.el6, httpd24-httpd-2.4.34-7.el6, httpd24-httpd-devel-2.4.34-7.el6 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7, httpd24-httpd-devel-2.4.34-7.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7, httpd24-httpd-devel-2.4.34-7.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7, httpd24-httpd-devel-2.4.34-7.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7, httpd24-httpd-devel-2.4.34-7.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-curl-7.61.1-1.el6, httpd24-httpd-2.4.34-7.el6, httpd24-httpd-devel-2.4.34-7.el6 +11
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7, httpd24-httpd-devel-2.4.34-7.el7 +12

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET Core 1.0 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
.NET Core 1.1 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
.NET Core 2.0 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
.NET Core 2.1 on Red Hat Enterprise LinuxAffectedNo fix planned: Will not fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Virtualization 3AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 3AffectedNo fix planned: Will not fix
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:3558

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1000100
  2. 2026-10-03 Alias added: GHSA-86r8-52rx-6jcr

References

Patch 2

Advisory 2

Other 1

  • TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
  • TI-2020-06702 Uncontrolled recursion in https://github.com/curl/curl CVSS 3.1HIGH 7.5
  • TI-2025-00616 gzip integer overflow CVSS 3.1HIGH 7.3
  • TI-2019-03845 Heap-based buffer overflow in curl CVSS 3.1HIGH 7.8
  • TI-2021-05737 Information disclosure in https://github.com/curl/curl CVSS 3.1MEDIUM 5.3
  • TI-2017-06326 Out-of-bounds read in curl and libcurl before 7.57.0 CVSS 3.1CRITICAL 9.8
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences