Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
Priority MEDIUM 59CWE-415Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-415 and the CVSS impact.
Summary
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07465 94th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | curl | 7.52.0 to 7.65.3 | — | No fix listed | CNA |
- curl Vendor— Affected 7.52.0 to 7.65.3 Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | 7.52.0 – 7.65.3 | Vulnerable | Haxx |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* | 3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Oracle |
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.52.0 – 7.65.3 Vulnerable ·Haxx
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_border_controller:8.3:*:*:*:*:*:*:* | 8.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* | 12.3.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | 5.7.0 – 5.7.28; 8.0.0 – 8.0.18 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:oss_support_tools:20.0:*:*:*:*:*:*:* | 20.0 | Vulnerable | Oracle |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
- cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_border_controller:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions 5.7.0 – 5.7.28; 8.0.0 – 8.0.18 Vulnerable ·Oracle
- cpe:2.3:a:oracle:oss_support_tools:20.0:*:*:*:*:*:*:* Versions 20.0 Vulnerable ·Oracle
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Remediation
Red Hat 2 advisories
- RHSA-2020:1792 Released 2020-04-28 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-12.el8, libcurl-7.61.1-12.el8, libcurl-devel-7.61.1-12.el8 +1
- RHSA-2020:0250 Released 2020-01-27 · Red Hat rating LowRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP1 Security Update
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-73.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-73.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-54.jbcs.el6 +38
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-73.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-73.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-54.jbcs.el7 +38
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
curl — openSUSE-SU-2019:2149
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03890 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.Priority HIGH 66
- Advisory ·
curl — openSUSE-SU-2019:2169
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03890 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.Priority HIGH 66
Show 3 more groups
- Advisory ·
curl — FEDORA-2019-f2a520135e
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03890 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.Priority HIGH 66
- Advisory ·
curl — FEDORA-2019-9e6357d82f
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03890 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.Priority HIGH 66
- Advisory ·
curl — FEDORA-2019-6d7f6fa2c8
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2019-03890 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.Priority HIGH 66
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:1792 |
| Red Hat JBoss Core Services on RHEL 6 Server | Fixed | RHSA-2020:0250 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2020:0250 |
Not affected: 6 products
- .NET Core 2.1 on Red Hat Enterprise Linux
- .NET Core 2.2 on Red Hat Enterprise Linux
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Web Server 5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5481
- 2026-10-03 Alias added: GHSA-hr98-frg6-wvvr
References
Patch 3
Sources
- CVE-2019-5481 · CVE Program
- CVE-2019-5481 · NVD
- FIRST EPSS
- GHSA-hr98-frg6-wvvr · GitHub Advisory Database · CC BY 4.0
- CVE-2019-5481 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences