Back
CVE-2005-0490
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to…
High8.8EPSS 5.7%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 5.7% · top 6.9% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
Affected products
n/a
- affected n/a
References (12)
- 20050228 [USN-86-1] cURL vulnerability (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- CLA-2005:940 (opens in a new tab)vendor-advisoryx_refsource_CONECTIVAx_transferred
- 20050221 Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnerability (opens in a new tab)third-party-advisoryx_refsource_IDEFENSEx_transferred
- oval:org.mitre.oval:def:10273 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
- 12616 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 12615 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- curl-kerberos-bo(19423) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
- 20050221 Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vulnerability (opens in a new tab)third-party-advisoryx_refsource_IDEFENSEx_transferred
- MDKSA-2005:048 (opens in a new tab)vendor-advisoryx_refsource_MANDRAKEx_transferred
- GLSA-200503-20 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- RHSA-2005:340 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- SUSE-SA:2005:011 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2005-0490)Record last updated .