CVE-2019-5443: haxx curl Code Injection
CVSS: 7.8v3.1HighModified
Published 02-07-2019Last modified 14-10-2026
Vulnerability summary
CVE-2019-5443 is a high (CVSS 7.8) Code Injection vulnerability in haxx curl. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.69%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 02-07-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesSingle source
Medium 4.4Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 18-09-2026
18-09-202618-10-2026
EPSS score0.69%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Affected systems
Netapp4 products
- oncommand_insightna
- oncommand_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)
- oncommand_workflow_automationna
- snapcenterna
Oracle4 products
- enterprise_manager_ops_center12.3.3 | 12.4.0
- http_server12.2.1.3.0 | 12.2.1.4.0
- mysql_server≥ 5.0.0, ≤ 5.7.27 | ≥ 8.0.0, ≤ 8.0.17
- oss_support_tools20.0
Haxx1 product
- curl≤ 7.65.1
3 vendors · 9 products
References
8 links- www.openwall.com/lists/oss-security/2019/06/24/1Mailing ListX Refsource MLISTPatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party Advisory