3.1
Low
CVE-2024-6874 libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to…
Description
libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string.
Affected products and versions
Other CVEs of curl
The 98 CVEs of curl →
CVE-2026-107929
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes…
8.1
High
CVE-2026-107928
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer
8.1
High
CVE-2026-94266
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
7.5
High
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might…
9.1
Critical