How many CVEs does curl curl have?

curl curl has 191 published CVE records since 2005.

How many curl curl CVEs are in CISA KEV?

None of curl curl's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for curl curl vulnerabilities?

Yes — 79 of curl curl's CVEs have a known public exploit.

Which versions of curl curl are affected?

1,634 distinct curl curl versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in curl curl CVEs?

curl curl's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-295 (Improper Certificate Validation), CWE-125 (Out-of-bounds Read).

How many critical curl curl vulnerabilities are there?

curl curl has 41 critical and 67 high-severity CVEs.

What is the average severity of curl curl CVEs?

The average CVSS base score across curl curl's scored CVEs is 7.1.

curl Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

curl has 191 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 79 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting curl, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of curl's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical41

High67

Medium71

Low12

In CISA’s Known Exploited Vulnerabilities catalog

None of curl's CVEs are currently listed in CISA's KEV catalog.

Public exploits

79 of curl's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every curl version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

curl-7_37_0114 CVEs
curl-7_37_1114 CVEs
curl-7_41_0114 CVEs
curl-7_46_0114 CVEs
curl-7_36_0113 CVEs
curl-7_38_0112 CVEs
curl-7_40_0112 CVEs
curl-7_42_0112 CVEs
curl-7_44_0112 CVEs
curl-7_45_0112 CVEs
curl-7_47_0112 CVEs
curl-7_47_1112 CVEs

Frequently asked questions

Common questions about curl vulnerabilities.

How many CVEs does curl curl have?: curl curl has 191 published CVE records since 2005.
How many curl curl CVEs are in CISA KEV?: None of curl curl's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for curl curl vulnerabilities?: Yes — 79 of curl curl's CVEs have a known public exploit.
Which versions of curl curl are affected?: 1,634 distinct curl curl versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in curl curl CVEs?: curl curl's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-295 (Improper Certificate Validation), CWE-125 (Out-of-bounds Read).
How many critical curl curl vulnerabilities are there?: curl curl has 41 critical and 67 high-severity CVEs.
What is the average severity of curl curl CVEs?: The average CVSS base score across curl curl's scored CVEs is 7.1.

curl Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Common weakness types

Disclosure activity by year

Other curl products

Frequently asked questions

References

Track curl vulnerabilities

Version ranges

Fixed in