CVE-2016-7167

36

FAUCET Score

CVE-2016-7167 describes multiple integer overflows in libcurl's escape and unescape functions (curl_escape, curl_easy_escape, curl_unescape, curl_easy_unescape) before version 7.50.3, affecting products like Fedora. This critical vulnerability, rated 9.8 CVSS, allows unauthenticated attackers to trigger a heap-based buffer overflow with a specially crafted string of maximum length, leading to high impact on confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		23CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:23:::::::*
		24CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:24:::::::*
		25CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:25:::::::*
		<= 7.50.2CPE matchmatch criteria	cpe:2.3:a:haxx:libcurl::::::::

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.0

Exploit Intelligence

EPSS Score

11.74%

Probability of exploitation in next 30 days

EPSS Percentile

95.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.1174 is in the 91st percentile among its peer group of 36,829 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

jitsipatch availablevia llm_extracted

Fixed in: 7.50.2

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-curl-0:7.61.1-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-httpd-0:2.4.34-7.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-nghttp2-0:1.7.1-7.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-curl-0:7.61.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-httpd-0:2.4.34-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-nghttp2-0:1.7.1-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: httpd24-curl-0:7.61.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: httpd24-httpd-0:2.4.34-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: httpd24-nghttp2-0:1.7.1-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-curl-0:7.61.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: curl-0:7.29.0-42.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-nghttp2-0:1.7.1-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-curl-0:7.61.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-httpd-0:2.4.34-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-nghttp2-0:1.7.1-7.el7

redhatpatch availablevia redhat_api

Product: Text-Only JBCSFixed in: jbcs-httpd24-curl

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-httpd-0:2.4.34-7.el7

sierra_wirelesspatch availablevia llm_extracted

Fixed in: 7.50.2

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: curl

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: curl

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Virtualization 3Fixed in: mingw-virt-viewer

redhatend of lifevia redhat_api

Product: .NET Core 2.1 on Red Hat Enterprise LinuxFixed in: rh-dotnet21-curl

Vendor Advisories (3)

redhatCVE-2016-7167Low

curl: escape and unescape integer overflows

sierra_wirelessllm-sierra_wireless-728866f2138edc16MEDIUM

curl escape and unescape integer overflows

jitsillm-jitsi-b9993042510bdbc1MEDIUM

curl escape and unescape integer overflows

References

access.redhat.com / errata/RHSA-2017:2016

access.redhat.com / errata/RHSA-2018:2486

access.redhat.com / errata/RHSA-2018:3558

curl.haxx.se / docs/adv_20160914.html

Vendor Advisory

lists.debian.org / debian-lts-announce/2018/11/msg00005.html

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK

security.gentoo.org / glsa/201701-47

oracle.com / technetwork/security-advisory/cpuoct2018-4428296.html

securityfocus.com / bid/92975

Broken Link

securitytracker.com / id/1036813

Third Party AdvisoryVDB Entry

slackware.com / security/viewer.php

Third Party Advisory