CVE-2018-1000005

## Vulnerability libcurl versions 7.49.0 through 7.57.0 inclusive contain an out-of-bounds read vulnerability in the code handling HTTP/2 trailers. When creating HTTP/1-like headers from HTTP/2 trailer data, the buffer size was miscalculated by one byte, causing a read beyond allocated memory. [1][3]

Exploitation

An attacker can trigger this by sending a crafted HTTP/2 response with trailers to a vulnerable libcurl client. No authentication is required; the attacker only needs network access to deliver the malicious response. The out-of-bounds read can cause a crash or pass oversized data to the client write callback. [3][4]

Impact

Successful exploitation leads to a denial of service (crash) or possible information disclosure if the application echoes back or processes the trailer data. The vulnerability has a CVSS severity of Low according to the curl project, but Red Hat rated it Important. [1][3]

Mitigation

The vulnerability is fixed in libcurl version 7.58.0. Users should upgrade to 7.58.0 or apply the patch from commit fa3dbb9a. Red Hat issued RHSA-2019:1543 for affected products, and Ubuntu published USN-3554-1. No workaround is available. [1][2][3]