curl: URL globbing out of bounds read
Published Oct 4, 2017
6.5
MEDIUMCVSS 3.1
EPSS 3.88%
Description
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
Affected products
No data.
- 7.4.1
- 7.35.0
- 7.36.0
- 7.37.0
- 7.37.1
- 7.38.0
- 7.39.0
- 7.40.0
- 7.41.0
- 7.42.0
- 7.42.1
- 7.43.0
- 7.44.0
- 7.45.0
- 7.46.0
- 7.47.0
- 7.47.1
- 7.48.0
- 7.49.0
- 7.49.1
- 7.50.0
- 7.50.1
- 7.50.2
- 7.50.3
- 7.51.0
- 7.52.0
- 7.52.1
- 7.53.0
- 7.53.1
- 7.54.0
- 7.54.1
- 7.55.0
No data.
Red Hat Software Collections for Red Hat Enterprise Linux 6
httpd24-curl-0:7.61.1-1.el6
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 6
httpd24-httpd-0:2.4.34-7.el6
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 6
httpd24-nghttp2-0:1.7.1-7.el6
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
.NET Core 1.0 on Red Hat Enterprise Linux
rh-dotnetcore10-curl
Out of support scope
.NET Core 1.1 on Red Hat Enterprise Linux
rh-dotnetcore11-curl
Out of support scope
.NET Core 2.0 on Red Hat Enterprise Linux
rh-dotnet20-curl
Out of support scope
.NET Core 2.1 on Red Hat Enterprise Linux
rh-dotnet21-curl
Will not fix
Red Hat Ceph Storage 2
curl
Not affected
Red Hat Enterprise Linux 5
curl
Not affected
Red Hat Enterprise Linux 6
curl
Not affected
Red Hat Enterprise Linux 7
curl
Not affected
Red Hat Enterprise Virtualization 3
mingw-virt-viewer
Not affected
Red Hat JBoss Enterprise Web Server 3
curl
Not affected
Red Hat Software Collections
httpd24-curl
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | httpd24-curl-0:7.61.1-1.el6 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | httpd24-httpd-0:2.4.34-7.el6 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | httpd24-nghttp2-0:1.7.1-7.el6 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| .NET Core 1.0 on Red Hat Enterprise Linux | rh-dotnetcore10-curl | Out of support scope | n/a |
| .NET Core 1.1 on Red Hat Enterprise Linux | rh-dotnetcore11-curl | Out of support scope | n/a |
| .NET Core 2.0 on Red Hat Enterprise Linux | rh-dotnet20-curl | Out of support scope | n/a |
| .NET Core 2.1 on Red Hat Enterprise Linux | rh-dotnet21-curl | Will not fix | n/a |
| Red Hat Ceph Storage 2 | curl | Not affected | n/a |
| Red Hat Enterprise Linux 5 | curl | Not affected | n/a |
| Red Hat Enterprise Linux 6 | curl | Not affected | n/a |
| Red Hat Enterprise Linux 7 | curl | Not affected | n/a |
| Red Hat Enterprise Virtualization 3 | mingw-virt-viewer | Not affected | n/a |
| Red Hat JBoss Enterprise Web Server 3 | curl | Not affected | n/a |
| Red Hat Software Collections | httpd24-curl | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1 other source (Red Hat) ▾
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
AV:N/AC:M/Au:N/C:P/I:N/A:N
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Apr 16, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 3.88% (0.03875) | 89.89th | v5 (v2026.06.15) |
| Jun 15, 2026 | 3.88% (0.03875) | 88.81th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.63% (0.00626) | 68.43th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.33% (0.00327) | 71.73th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.33% (0.00327) | 70.07th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.33% (0.00327) | 66.19th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.11% (0.01108) | 55.18th | v2 (v2022.01.01) |
| Sep 17, 2022 | 1.11% (0.01108) | 53.57th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.11% (0.01108) | 51.54th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.11% (0.01108) | 29.61th | v2 (v2022.01.01) |
| Feb 3, 2022 | 1.66% (0.01659) | 34.20th | v1 |
| Jan 6, 2022 | 1.66% (0.01659) | 33.50th | v1 |
| Sep 1, 2021 | 1.66% (0.01659) | 73.96th | v1 |
| Apr 14, 2021 | 1.66% (0.01659) | 0.00th | v1 |
References (11)
- http://www.debian.org/security/2017/dsa-3992 vendor-advisoryx_refsource_DEBIAN
- http://www.securityfocus.com/bid/100249 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039117 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3558 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2017-1000101 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1478309 Issue Tracking
- https://curl.haxx.se/docs/adv_20170809A.html x_refsource_CONFIRMIssue TrackingVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000101
- https://security.gentoo.org/glsa/201709-14 vendor-advisoryx_refsource_GENTOOIssue TrackingThird Party Advisory
- https://support.apple.com/HT208221 x_refsource_CONFIRM
- https://www.cve.org/CVERecord?id=CVE-2017-1000101
| Link | Providers | Tags |
|---|---|---|
| http://www.debian.org/security/2017/dsa-3992 | vendor-advisoryx_refsource_DEBIAN | |
| http://www.securityfocus.com/bid/100249 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| http://www.securitytracker.com/id/1039117 | vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/errata/RHSA-2018:3558 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/security/cve/CVE-2017-1000101 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1478309 | Issue Tracking | |
| https://curl.haxx.se/docs/adv_20170809A.html | x_refsource_CONFIRMIssue TrackingVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2017-1000101 | ||
| https://security.gentoo.org/glsa/201709-14 | vendor-advisoryx_refsource_GENTOOIssue TrackingThird Party Advisory | |
| https://support.apple.com/HT208221 | x_refsource_CONFIRM | |
| https://www.cve.org/CVERecord?id=CVE-2017-1000101 |
Change history (0)
No recorded changes yet.