CVE-2017-1000101: haxx curl
Vulnerability summary
CVE-2017-1000101 is a medium (CVSS 6.5) vulnerability in haxx curl. EPSS estimates a 3.72% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 04-10-2017PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
CVSS metrics
8 scores · 5 sources · 3 versions- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
3.72%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
Decrease -0.15 pp
From 3.88% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- curl< 7.55.0-r0
Debian1 product
- curl< 7.55.0-1
Haxx1 product
- curl7.4.1 | 7.35.0 | 7.36.0 | 7.37.0 | 7.37.1 | 7.38.0 | 7.39.0 | 7.40.0 | 7.41.0 | 7.42.0 | 7.42.1 | 7.43.0 | 7.44.0 | 7.45.0 | 7.46.0 | 7.47.0 | 7.47.1 | 7.48.0 | 7.49.0 | 7.49.1 | 7.50.0 | 7.50.1 | 7.50.2 | 7.50.3 | 7.51.0 | 7.52.0 | 7.52.1 | 7.53.0 | 7.53.1 | 7.54.0 | 7.54.1 | 7.55.0
Ubuntu1 product
- curl< 7.35.0-1ubuntu2.11 | < 7.47.0-1ubuntu2.3
4 vendors · 4 products
References
12 links- support.apple.com/HT208221X Refsource CONFIRM
- security.gentoo.org/glsa/201709-14Vendor AdvisoryX Refsource GENTOOIssue TrackingThird Party Advisory
