Unscored severity · published Feb 2, 2014
CVE-2014-0015
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to…
–
CVSS
5.6%
EPSS
No
On KEV
Description
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Curl · Haxx
7.10.6; 7.10.7; 7.10.8; 7.11.0; 7.11.1; 7.11.2; +34 more · source: NVD
LI
Libcurl · Haxx
7.10.6; 7.10.7; 7.10.8; 7.11.0; 7.11.1; 7.11.2; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0015
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0015
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html
Patch
http://curl.haxx.se/docs/adv_20140129.html
kb.juniper.net
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127627.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128408.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-02/msg00066.html
More from Curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF