5.3
Medium
CVE-2023-46219 When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent…
Description
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| curl | 8.4.0 | No fix stated |
| curl 7.84 | earliest → < 7.84.0 | 7.84.0 |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| SINEC NMS | Versions not published |
References
- hackerone.com hackerone.com
- curl.se curl.se
- lists.fedoraproject.org lists.fedoraproject.org
- www.debian.org www.debian.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of curl
The 98 CVEs of curl →
CVE-2026-107929
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes…
8.1
High
CVE-2026-107928
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer
8.1
High
CVE-2026-94266
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
7.5
High
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might…
9.1
Critical