CVE Vulnerability Catalog

Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnUser parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

libcurl could accidentally return a URL for curl_easy_getinfo()'s CURLINFO_EFFECTIVE_URL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

When processing an HTTP redirect to a URL containing userinfo (a username:password component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of --location-trusted.

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curl_mime_free leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.

When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the Content-Disposition header despite the -J non-overwrite constraint.

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent CURLOPT_READDATA pointer, including data remaining from unrelated prior operations such as an HTTP POST request executed on a reused handle.

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via curl_easy_duphandle() copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read; alternatively, reusing the original or cloned handle while changing only CURLOPT_WRITEDATA results in type confusion.

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate, tricked by a manipulated validity length field, extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback.

Enabling CURLOPT_CRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache, and the save error is silently ignored.

Importing an includeSubDomains parent HSTS entry before a longer-lived child entry silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer.

An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password or a Negotiate/Kerberos ticket) to the proxy itself by answering the CONNECT tunnel request with 401 WWW-Authenticate instead of the expected 407 Proxy-Authenticate.

A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_gw parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.