The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would b…

Published 8 y ago 2018-07-31 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.7

v3.0 · CNA

CISA KEV

not known exploited

EPSS

4.7%

percentile 92%

Public exploits

none known

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago 2026-04-15

Exploit prediction (EPSS)

4.67% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	3.7	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`
CNA	3.0	3.7	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Affected products

The Curl Project curl

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

access.redhat.com /errata/RHSA-2018:3558 · vendor-advisory, x_refsource_REDHAT, x_transferred
curl.haxx.se /docs/adv_20161102H.html · x_refsource_CONFIRM, x_transferred
tenable.com /security/tns-2016-21 · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1037192 · vdb-entry, x_refsource_SECTRACK, x_transferred
oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/94105 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHSA-2018:2486 · vendor-advisory, x_refsource_REDHAT, x_transferred
security.gentoo.org /glsa/201701-47 · vendor-advisory, x_refsource_GENTOO, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-8622 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2016-8622
NVD: CVE-2016-8622

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary