CVE-2014-0138

no score yetEPSS 5.2%

The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.

EPSS: 5.2% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2014-04-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
haxx:curl
haxx:libcurl

References

http://curl.haxx.se/docs/adv_20140326A.html
http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html
http://seclists.org/fulldisclosure/2014/Dec/23
http://secunia.com/advisories/57836
http://secunia.com/advisories/57966

Check your stack JSON