Out-of-bounds read in curl
Priority MEDIUM 41CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05351 92nd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Curl Project | curl | 7.64.0 | — | No fix listed | CNA |
- curl VendorThe Curl Project Affected 7.64.0 Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* | 7.36.0 to before 7.64.0 | Vulnerable | Haxx |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:* | all versions | Vulnerable | NetApp |
| cpe:2.3:a:siemens:sinema_remote_connect_client:*:*:*:*:*:*:*:* | up to 2.0 | Vulnerable | Siemens |
| cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* | 3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Oracle |
- cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* Versions 7.36.0 to before 7.64.0 Vulnerable ·Haxx
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·NetApp
- cpe:2.3:a:siemens:sinema_remote_connect_client:*:*:*:*:*:*:*:* Versions up to 2.0 Vulnerable ·Siemens
- cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:* | 5.4 | Vulnerable | Oracle |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | 13.1.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.0.1 | Vulnerable | F5 |
- cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Oracle
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.0.1 Vulnerable ·F5
Remediation
Red Hat 2 advisories
- RHSA-2019:3701 Released 2019-11-05 · Red Hat rating Moderatecurl security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-11.el8, libcurl-7.61.1-11.el8, libcurl-devel-7.61.1-11.el8 +1
- RHSA-2019:1543 Released 2019-06-18 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update
- JBoss Core Services Apache HTTP Server 2.4.29 SP2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
The curl Project curl — USN-3882-1
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2019-02834 Stack-based buffer overflow in curlPriority MEDIUM 56
- TI-2019-02835 Out-of-bounds read in curlPriority MEDIUM 40
- Advisory ·
The curl Project curl — DSA-4386
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2019-02834 Stack-based buffer overflow in curlPriority MEDIUM 56
- TI-2019-02835 Out-of-bounds read in curlPriority MEDIUM 40
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core 1.0 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| .NET Core 1.1 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| .NET Core 2.1 on Red Hat Enterprise Linux | Affected | No fix planned: Will not fix |
| .NET Core 2.2 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Core Services | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| JBoss Core Services Apache HTTP Server 2.4.29 SP2 | Fixed | RHSA-2019:1543 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2019:3701 |
Not affected: 4 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Web Server 5
Timeline
- 2026-10-02 Threatist record created from CVE-2018-16890
- 2026-10-03 Alias added: GHSA-53fg-3j53-939q
References
Patch 5
- https://curl.haxx.se/docs/CVE-2018-16890.html
- https://security.netapp.com/advisory/ntap-20190315-0001/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Advisory 4
More The Curl Project vulnerabilities
- TI-2019-02834 Stack-based buffer overflow in curl CVSS 3.1CRITICAL 9.8
- TI-2016-07082 Buffer overflow in curl CVSS 3.0CRITICAL 9.8
- TI-2018-12049 Heap-based buffer overflow in curl: CVSS 3.0CRITICAL 9.8
- TI-2016-07084 Heap-based buffer overflow in curl CVSS 3.0CRITICAL 9.8
- TI-2016-07081 The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. CVSS 3.0CRITICAL 9.8
- TI-2016-07080 Use after free in curl CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-16890 · CVE Program
- CVE-2018-16890 · NVD
- FIRST EPSS
- GHSA-53fg-3j53-939q · GitHub Advisory Database · CC BY 4.0
- CVE-2018-16890 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences