libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties.

published 2018-01-24 8y ago modified 2026-06-17 4mo ago also EUVD-2018-1778

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 9.9%; EPSS 9.9% chance of exploitation in 30 days, percentile 95%
public exploits: 0; none known

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

Patch / fix

fixed in 6 distros 5 links 2

fujitsu m10-1_firmware xcp2361, xcp3070
fujitsu m10-4_firmware xcp2361, xcp3070
fujitsu m10-4s_firmware xcp2361, xcp3070
fujitsu m12-1_firmware xcp2361, xcp3070
fujitsu m12-2_firmware xcp2361, xcp3070
fujitsu m12-2s_firmware xcp2361, xcp3070

debian ubuntu red hat suse arch linux

curl Debian 14, Debian 13, Debian 12 7.58.0-1

debian advisories DEBIAN-CVE-2018-1000007

curl Ubuntu 14.04 LTS 7.35.0-1ubuntu2.14
curl Ubuntu 16.04 LTS 7.47.0-1ubuntu2.6

ubuntu advisories UBUNTU-CVE-2018-1000007

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el6
httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
httpd24-mod_md RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
httpd24-mod_ssl RHEL 3 SOFTWARE_COLLECTIONS 1:2.4.34-7.el6

red hat advisories RHSA-2020:0594 RHSA-2020:0544 RHSA-2018:3558 RHSA-2018:3157

curl SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 7.19.7-1.70.13.1
curl-openssl1 SLES 11-SECURITY 7.19.7-1.70.13.1
curl SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +6 more 7.37.0-37.14.1
curl Studio Onsite 1.3 7.19.7-1.20.53.13.1

suse advisories SUSE-SU-2018:0230-1 SUSE-SU-2018:0217-1 SUSE-SU-2018:0214-1

curl Arch Linux 7.58.0-1
lib32-curl Arch Linux 7.58.0-1
libcurl-compat Arch Linux 7.58.0-1
libcurl-gnutls Arch Linux 7.58.0-1
lib32-libcurl-gnutls Arch Linux 7.58.0-1
lib32-libcurl-compat Arch Linux 7.58.0-1

arch linux advisories AVG-593 AVG-594 AVG-595 AVG-596 AVG-597 AVG-598

curl.haxx.se/docs/adv_2018-b3bf.html advisory
oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html advisory

Is CVE-2018-1000007 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000007 updated 2026-11-05 cvss 6.5

curl: HTTP authentication leak in redirects

Red Hat .NET Core 1.0 on Red Hat Enterprise Linux rh-dotnetcore10-curl Red Hat .NET Core 1.1 on Red Hat Enterprise Linux rh-dotnetcore11-curl Red Hat .NET Core 2.0 on Red Hat Enterprise Linux rh-dotnet20-curl
affected: workaround, no fix planned “Out of support scope”
Red Hat .NET Core 2.1 on Red Hat Enterprise Linux rh-dotnet21-curl, rh-dotnet21-libcurl
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux 5 curl Red Hat Enterprise Linux 6 curl, libcurl
affected: workaround, no fix planned “Out of support scope”
Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2
fixed: vendor fix RHSA-2019:1543
Red Hat Enterprise Linux Client (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7 Red Hat Enterprise Linux ComputeNode (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
fixed: vendor fix RHSA-2018:3157
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1
fixed: vendor fix RHSA-2020:0544
Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7
fixed: vendor fix RHSA-2018:3157
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) libcurl-devel 7.29.0-46.el7_5.1, curl-debuginfo 7.29.0-46.el7_5.1
fixed: vendor fix RHSA-2020:0544

show 7 more

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
fixed: vendor fix RHSA-2018:3157
Red Hat Enterprise Linux Server AUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2 Red Hat Enterprise Linux Server E4S (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2
fixed: vendor fix RHSA-2020:0594
Red Hat Enterprise Linux Server EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1
fixed: vendor fix RHSA-2020:0544
Red Hat Enterprise Linux Server TUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2
fixed: vendor fix RHSA-2020:0594
Red Hat Enterprise Linux Workstation (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
fixed: vendor fix RHSA-2018:3157
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 more

+1 more productsfewer

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more

fixed: vendor fix RHSA-2018:3558
Red Hat Ceph Storage 2 curl, libcurl
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

9.91% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

References

curl.haxx.se /docs/adv_2018-b3bf.html
patch, vendor-advisory
oracle.com /technetwork/security-advisory/cpuoct2019-5072832.html
patch, third-party-advisory
usn.ubuntu.com /3554-2/
vendor-advisory, third-party-advisory
usn.ubuntu.com /3554-1/
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2018:3558
vendor-advisory, third-party-advisory
debian.org /security/2018/dsa-4098
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2018:3157
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHBA-2019:0327
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:1543
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2020:0544
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2020:0594
vendor-advisory, third-party-advisory
securitytracker.com /id/1040274
vdb-entry, third-party-advisory
lists.debian.org /debian-lts-announce/2018/01/msg00038.html
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2022/04/27/4
mailing-list, third-party-advisory

Sources

CVE List CVE-2018-1000007
NVD CVE-2018-1000007

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.