curl 7.83

Status EOLSupport 2022-04 – 2022-06Latest 7.83.1Vulnerabilities 48← All curl versions
Critical 9.8
2022-07-07≤ 7.83.1

curl: Unpreserved file permissions

Critical 9.8
2022-12-05≤ 7.83.1

curl: POST following PUT confusion

Critical 9.8
2023-03-30≤ 7.83.1

curl: TELNET option IAC injection

Critical 9.1
2023-02-23≤ 7.83.1

curl: HSTS ignored on multiple requests

High 8.8
2023-03-30≤ 7.83.1

curl: SFTP path ~ resolving discrepancy

High 8.6
2024-03-27≤ 7.83.1

HTTP/2 push headers memory-leak

High 8.1
2022-06-01= 7.83.0

curl: removes wrong file on error

High 8.1
2022-10-29≤ 7.83.1

curl: HTTP proxy double-free

High 7.5
2022-06-01≤ 7.83.0

curl: CERTINFO never-ending busy-loop

High 7.5
2022-06-01≤ 7.83.0

curl: TLS and SSH connection too eager reuse

High 7.5
2022-10-29≤ 7.83.1

curl: HSTS bypass via IDN

High 7.5
2022-12-23≤ 7.83.1

curl: HSTS bypass via IDN

High 7.5
2023-05-26≤ 7.83.1

curl: use after free in SSH sha256 fingerprint check

High 7.3
2025-01-01≤ 7.83.1

gzip integer overflow

Medium 6.5 Unfixed
2026-03-11≤ 7.83.1

wrong proxy connection reuse with credentials

Medium 6.5 Unfixed
2026-03-11≤ 7.83.1

bad reuse of HTTP Negotiate connection

Medium 6.5
2022-07-07≤ 7.83.1

curl: HTTP compression denial of service

Medium 6.5
2023-02-23≤ 7.83.1

curl: HSTS amnesia with --parallel

Medium 6.5
2023-02-23≤ 7.83.1

curl: HTTP multi-header compression denial of service

Medium 6.5
2023-12-07≤ 7.83.1

curl: information disclosure by exploiting a mixed case flaw

Medium 6.5
2024-09-11≤ 7.83.1

OCSP stapling bypass with GnuTLS

Medium 6.3 Unfixed
2026-01-08≤ 7.83.1

broken TLS options for threaded LDAPS

Medium 5.9
2024-11-06≤ 7.83.1

HSTS subdomain overwrites parent cache entry

Medium 5.9
2022-07-07≤ 7.83.1

curl: FTP-KRB bad message verification

Medium 5.9
2023-02-09≤ 7.83.1

curl: Use-after-free triggered by an HTTP proxy deny response

Medium 5.9
2023-05-26≤ 7.83.1

curl: siglongjmp race condition may lead to crash

Medium 5.9
2023-05-26≤ 7.83.1

curl: IDN wildcard match may lead to Improper Cerificate Validation

Medium 5.3 Unfixed
2026-04-29≤ 7.83.1

curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies

Medium 5.3 Unfixed
2026-04-29≤ 7.83.1

curl: curl: Information disclosure due to incorrect TLS connection reuse

Medium 5.3 Unfixed
2026-03-11≤ 7.83.1

token leak with redirect and netrc

Medium 5.3 Unfixed
2026-01-08≤ 7.83.1

libssh global known_hosts override

Medium 5.3 Unfixed
2026-01-08≤ 7.83.1

bearer token leak on cross-protocol redirect

Medium 5.3
2022-06-01≤ 7.83.0

curl: cookie for trailing dot TLD

Medium 5.3
2022-06-01≤ 7.83.0

curl: percent-encoded path separator in URL host

Medium 5.3
2023-05-26≤ 7.83.1

curl: more POST-after-PUT confusion

Medium 4.3 Unfixed
2025-11-07≤ 7.83.1

missing SFTP host verification with wolfSSH

Medium 4.3
2022-06-01≤ 7.83.0

curl: HSTS bypass via trailing dot

Medium 4.3
2022-07-07≤ 7.83.1

curl: Set-Cookie denial of service

Low 3.7
2022-09-23≤ 7.83.1

curl: Incorrect handling of control code characters in cookies

Low 3.4
2025-01-01≤ 7.83.1

netrc and default credential leak

Low 3.4
2024-12-11≤ 7.83.1

netrc and redirect credential leak

Low 3.1 Unfixed
2026-01-08≤ 7.83.1

libssh key passphrase bypass without agent set

N/A
2023-03-30≤ 7.83.1

N/A
2023-03-30≤ 7.83.1

N/A
2023-03-30≤ 7.83.1

N/A
2023-10-18≤ 7.83.1

N/A
2023-10-18≤ 7.83.1

N/A
2024-07-31≤ 7.83.1