Medium severity5.3NVD Advisory· Published Jul 31, 2018· Updated Jun 17, 2026
CVE-2016-8624
CVE-2016-8624
Description
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12- osv-coords10 versionspkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Studio%20Onsite%201.3pkg:rpm/suse/curl-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY
< 7.51.0-1.1+ 9 more
- (no CPE)range: < 7.51.0-1.1
- (no CPE)range: < 7.37.0-31.1
- (no CPE)range: < 7.19.7-1.64.1
- (no CPE)range: < 7.37.0-31.1
- (no CPE)range: < 7.19.7-1.64.1
- (no CPE)range: < 7.37.0-31.1
- (no CPE)range: < 7.19.7-1.64.1
- (no CPE)range: < 7.37.0-31.1
- (no CPE)range: < 7.19.7-1.20.47.2
- (no CPE)range: < 7.19.7-1.64.1
- The Curl Project/curlv5Range: 7.51.0
Patches
Vulnerability mechanics
References
12- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party Advisory
- curl.haxx.se/docs/adv_20161102J.htmlnvdPatchVendor Advisory
- www.securityfocus.com/bid/94103nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1037192nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2018:2486nvdThird Party Advisory
- security.gentoo.org/glsa/201701-47nvdThird Party Advisory
- www.tenable.com/security/tns-2016-21nvdThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlnvd
- access.redhat.com/errata/RHSA-2018:3558nvd
- lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Envd
- lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Envd
- lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3Envd
News mentions
0No linked articles in our index yet.