CVE-2017-8816

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

• CWE-190
• CWE-190

• https://security.cucumberlinux.com/security/details.php?id=161Third Party Advisory
• https://www.securityfocus.com/bid/101998Third Party Advisory, VDB Entry
• https://www.securitytracker.com/id/1039896Third Party Advisory, VDB Entry
• https://www.securitytracker.com/id/1040608
• https://access.redhat.com/errata/RHSA-2018:3558
• https://curl.haxx.se/docs/adv_2017-12e7.htmlMitigation, Vendor Advisory
• https://security.gentoo.org/glsa/201712-04Third Party Advisory
• https://www.debian.org/security/2017/dsa-4051Third Party Advisory
• https://security.cucumberlinux.com/security/details.php?id=161Third Party Advisory
• https://www.securityfocus.com/bid/101998Third Party Advisory, VDB Entry
• https://www.securitytracker.com/id/1039896Third Party Advisory, VDB Entry
• https://www.securitytracker.com/id/1040608
• https://access.redhat.com/errata/RHSA-2018:3558
• https://curl.haxx.se/docs/adv_2017-12e7.htmlMitigation, Vendor Advisory
• https://security.gentoo.org/glsa/201712-04Third Party Advisory
• https://www.debian.org/security/2017/dsa-4051Third Party Advisory

Published

Nov 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8810MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x be…
• CVE-2017-8811The implementation of raw message parameter expansion in Med…
• CVE-2017-8812MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x be…
• CVE-2017-8813Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8814The language converter in MediaWiki before 1.27.4, 1.28.x be…
• CVE-2017-8815The language converter in MediaWiki before 1.27.4, 1.28.x be…
• CVE-2017-8817The FTP wildcard function in curl and libcurl before 7.57.0 …9.8
• CVE-2017-8818curl and libcurl before 7.57.0 on 32-bit platforms allow att…
• CVE-2017-8819In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17,…
• CVE-2017-8820In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17,…
• CVE-2017-8821In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17,…
• CVE-2017-8822In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17,…