CVE detail
CVE-2016-8623
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 11.0 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
2 source links · newest first
- An audit revealed dozen vulnerabilities in the cURLSecurity Affairs
Security experts who conducted an audit on cURL discovered nearly a dozen vulnerabilities that were patched in the last release. The cURL (read “see URL”) is an open source command line tool and library designed for transferring data through various protocols. The cURL is included in a wide range of applications, including networking devices, printers, smartphones, IoT devices […]
newssecurityaffairs.comNov 29, 2016, 6:55 AM The latest version of cURL patches nearly a dozen vulnerabilities, more than half of which were discovered as a result of an audit conducted recently by security experts.
newswww.securityweek.comNov 28, 2016, 12:06 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-9080CVSS 7.3 · High
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangl…
- CVE-2026-10536CVSS 9.8 · Critical
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subseq…
- CVE-2026-3805CVSS 7.5 · High
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- CVE-2023-28319CVSS 7.5 · High
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl…
- CVE-2022-43552CVSS 5.9 · Medium
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) den…
- CVE-2021-22901CVSS 8.1 · High
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A mali…