4 ms·
How often have libcurl HTTP or TLS backend bugs resulted in exploited vulnerabilities in the past?
by mehrdadn 6y ago
How often have libcurl HTTP or TLS backend bugs resulted in exploited vulnerabilities in the past?
- kingkilr 6y agoI don't have any data on exploitability, but 19 of the last 22 vulnerabilities (since 2018) have C-induced memory unsafety as a cause: https://curl.haxx.se/docs/security.html https://curl.haxx.se/docs/security.html
- mehrdadn 6y agoOh thanks, that at least gives some idea of the potential. I see e.g. "HTTP/2 trailer out-of-bounds read" and "SSL out of buffer access"... I guess there might be some candidates.