← Vulnerability feed

Vulnerability record · CVE-2005-0490 · published 2 May 2005

CVE-2005-0490: Haxx curl vulnerability

Haxx · Curl

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

8.8 CVSS 3.1 High EPSS 5.7% · top 7.2% CWE-131 · CWE-131
8.8CVSS 3.1 base score, v2 5.1
5.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
24References
16 Jun 2026Last modified by NVD

Description

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940 Broken LinkPatchVendor Advisory
http://marc.info/?l=full-disclosure&m=110959085507755&w=2 Mailing ListPatch
http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml Third Party Advisory
http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities Broken LinkVendor Advisory
http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities Broken LinkVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:048 Third Party Advisory
http://www.novell.com/linux/security/advisories/2005_11_curl.html Broken Link
http://www.redhat.com/support/errata/RHSA-2005-340.html Broken Link
http://www.securityfocus.com/bid/12615 Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/12616 Broken LinkThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/19423 Third Party AdvisoryVDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273 Broken Link
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940 Broken LinkPatchVendor Advisory
http://marc.info/?l=full-disclosure&m=110959085507755&w=2 Mailing ListPatch
http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml Third Party Advisory
http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities Broken LinkVendor Advisory
http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities Broken LinkVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:048 Third Party Advisory
http://www.novell.com/linux/security/advisories/2005_11_curl.html Broken Link
http://www.redhat.com/support/errata/RHSA-2005-340.html Broken Link
http://www.securityfocus.com/bid/12615 Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/12616 Broken LinkThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/19423 Third Party AdvisoryVDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273 Broken Link

Track CVE-2005-0490 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-19931Haxx curl vulnerabilityA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is do…EPSS 0.75%9.8CVE-2026-9079Haxx curl insufficiently protected credentials vulnerabilitylibcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get …EPSS 0.58%9.8CVE-2026-8925Haxx curl double free vulnerabilityThe curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making…EPSS 1.1%9.8CVE-2026-10536Haxx curl use after free vulnerabilityA use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CUR…EPSS 0.60%9.8CVE-2026-11856Haxx curl authentication bypass by capture-replay vulnerabilitySuccessfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a diff…EPSS 0.69%9.8CVE-2023-38545curl SOCKS5 proxy handshake heap buffer overflowcurl contains a heap-based out-of-bounds write (CWE-787) in the SOCKS5 proxy handshake. When a host name longer than 255 bytes is passed for proxy-si…EPSS 78%analysed9.8CVE-2022-32221Haxx curl information exposure vulnerabilityWhen doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOP…EPSS 4.4%9.8CVE-2022-32207Haxx curl incorrect default permissions vulnerabilityWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from …EPSS 7.7%

Source: NIST National Vulnerability Database (record CVE-2005-0490), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.