| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.10.5, < 8.12.0 | 8.12.0 |
| libcurl | ≥ 7.10.5, < 8.12.0 | 8.12.0 |
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free