Skip to content
fr Sign in
3.1 Low

CVE-2024-6874 libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to…

Description

libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string.

Affected products and versions

Product Affected versions Fixed in
curl 8.8.0 No fix stated
libcurl 8.8.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of curl

The 98 CVEs of curl →
CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes… 8.1 High CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer 8.1 High CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing… 7.5 High CVE-2026-94265 When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might… 9.1 Critical
Track this CVE