CVE-2016-8624
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 31, 2018
- Updated
- Apr 16, 2026
- Reserved
- Oct 12, 2016
Description
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
curlThe Curl Project |
|
References
- RHSA-2018:3558vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624
- https://www.tenable.com/security/tns-2016-21
- 1037192vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://curl.haxx.se/docs/adv_20161102J.html
- RHSA-2018:2486vendor-advisory
- GLSA-201701-47vendor-advisory
- 94103vdb-entry
- [pulsar-commits] 20200914 [GitHub] [pulsar] klwilson227 opened a new issue #8061: CVE-2017-14063mailing-list
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8mailing-list
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.