CVE-2016-8622
Last modified
CVE-2016-8622 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. EPSS estimates a 4.67% chance of exploitation in the next 30 days.
Description
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
Metrics
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Libcurl | < 7.51.0 |
References
- http://www.securityfocus.com/bid/94105Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037192Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2486Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622Issue Tracking, Patch, Third Party Advisory
- https://curl.haxx.se/docs/adv_20161102H.htmlPatch, Vendor Advisory
- https://security.gentoo.org/glsa/201701-47Third Party Advisory
- https://www.tenable.com/security/tns-2016-21Third Party Advisory
- http://www.securityfocus.com/bid/94105Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037192Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2486Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622Issue Tracking, Patch, Third Party Advisory
- https://curl.haxx.se/docs/adv_20161102H.htmlPatch, Vendor Advisory
- https://security.gentoo.org/glsa/201701-47Third Party Advisory
- https://www.tenable.com/security/tns-2016-21Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-8622?
How severe is CVE-2016-8622?
How do I fix CVE-2016-8622?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-8616A flaw was found in curl before version 7.51.0 When re-using…3.7
- CVE-2016-8617The base64 encode function in curl before version 7.51.0 is …3.3
- CVE-2016-8618The libcurl API function called `curl_maprintf()` before ver…5.3
- CVE-2016-8619The function `read_data()` in security.c in curl before vers…5.3
- CVE-2016-8620The 'globbing' feature in curl before version 7.51.0 has a f…6.5
- CVE-2016-8621The `curl_getdate` function in curl before version 7.51.0 is…5.3
- CVE-2016-8623A flaw was found in curl before version 7.51.0. The way curl…3.3
- CVE-2016-8624curl before version 7.51.0 doesn't parse the authority compo…5.3
- CVE-2016-8625curl before version 7.51.0 uses outdated IDNA 2003 standard …5.3
- CVE-2016-8626A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ce…6.5
- CVE-2016-8627admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulner…4.3
- CVE-2016-8628Ansible before version 2.2.0 fails to properly sanitize fact…7.6
Are you affected by CVE-2016-8622?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST