Stack-based buffer overflow in curl
Priority MEDIUM 56CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.
Summary
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.12873 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Curl Project | curl | 7.64.0 | — | No fix listed | CNA |
- curl VendorThe Curl Project Affected 7.64.0 Fixed in — No fix listed CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* | 7.36.0 to before 7.64.0 | Vulnerable | Haxx |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* | 7.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:* | 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:* | all versions | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* Versions 7.36.0 to before 7.64.0 Vulnerable ·Haxx
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:* Versions 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:siemens:sinema_remote_connect_client:*:*:*:*:*:*:*:* | up to 2.0 | Vulnerable | Siemens |
| cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* | 3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* | 12.3.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | up to 5.7.26; 5.7.27 – 8.0.15 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:* | 5.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:services_tools_bundle:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Oracle |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:siemens:sinema_remote_connect_client:*:*:*:*:*:*:*:* Versions up to 2.0 Vulnerable ·Siemens
- cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions up to 5.7.26; 5.7.27 – 8.0.15 Vulnerable ·Oracle
- cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:services_tools_bundle:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Remediation
Red Hat 2 advisories
- RHSA-2019:3701 Released 2019-11-05 · Red Hat rating Moderatecurl security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-11.el8, libcurl-7.61.1-11.el8, libcurl-devel-7.61.1-11.el8 +1
- RHSA-2019:1543 Released 2019-06-18 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update
- JBoss Core Services Apache HTTP Server 2.4.29 SP2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
The curl Project curl — USN-3882-1
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2018-12100 Out-of-bounds read in curlPriority MEDIUM 41
- TI-2019-02835 Out-of-bounds read in curlPriority MEDIUM 40
- Advisory ·
The curl Project curl — DSA-4386
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2018-12100 Out-of-bounds read in curlPriority MEDIUM 41
- TI-2019-02835 Out-of-bounds read in curlPriority MEDIUM 40
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core 1.0 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| .NET Core 1.1 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| .NET Core 2.1 on Red Hat Enterprise Linux | Affected | No fix planned: Will not fix |
| .NET Core 2.2 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Core Services | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| JBoss Core Services Apache HTTP Server 2.4.29 SP2 | Fixed | RHSA-2019:1543 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2019:3701 |
Not affected: 4 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Web Server 5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3822
- 2026-10-03 Alias added: GHSA-8wr2-mqj7-7vxp
References
Patch 4
Advisory 7
More The Curl Project vulnerabilities
- TI-2016-07082 Buffer overflow in curl CVSS 3.0CRITICAL 9.8
- TI-2018-12049 Heap-based buffer overflow in curl: CVSS 3.0CRITICAL 9.8
- TI-2016-07084 Heap-based buffer overflow in curl CVSS 3.0CRITICAL 9.8
- TI-2016-07081 The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. CVSS 3.0CRITICAL 9.8
- TI-2016-07080 Use after free in curl CVSS 3.0CRITICAL 9.8
- TI-2018-12050 Use after free in curl CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-3822 · CVE Program
- CVE-2019-3822 · NVD
- FIRST EPSS
- GHSA-8wr2-mqj7-7vxp · GitHub Advisory Database · CC BY 4.0
- CVE-2019-3822 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences