CVE-2016-0755

30

FAUCET Score

CVE-2016-0755 describes a vulnerability in libcurl versions prior to 7.47.0, specifically within the ConnectionExists function in lib/url.c, affecting products like canonical curl, Debian curl, and haxx curl. This flaw prevents proper re-use of NTLM-authenticated proxy connections, potentially allowing remote attackers to authenticate as other users. With a CVSS v3 score of 7.3 (HIGH), this vulnerability has a network attack vector, low attack complexity, and could lead to low impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 7.46.0CPE matchmatch criteria	cpe:2.3:a:haxx:curl::::::::
		12.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
		14.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
		15.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*
		15.10CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*

CVSS Data

CVSS version used by this source: 3.0

7.3HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

Exploitability Score

3.9

Impact Score

3.4

CvssVersion

3.0

Exploit Intelligence

EPSS Score

9.33%

Probability of exploitation in next 30 days

EPSS Percentile

94.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0933 is in the 92nd percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

jitsipatch availablevia llm_extracted

Fixed in: 7.46.0

sierra_wirelesspatch availablevia llm_extracted

Fixed in: 7.46.0

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: curl

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: curl

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: curl

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 3Fixed in: curl

Vendor Advisories (3)

redhatCVE-2016-0755Low

curl: NTLM credentials not-checked for proxy connection re-use

sierra_wirelessllm-sierra_wireless-6d90f626a266afc7MEDIUM

NTLM credentials not-checked for proxy connection reuse

jitsillm-jitsi-0bb80e69a2372b7eMEDIUM

NTLM credentials not-checked for proxy connection reuse

References

curl.haxx.se / docs/adv_20160127A.html

Vendor Advisory

lists.apple.com / archives/security-announce/2016/Sep/msg00006.html

lists.fedoraproject.org / pipermail/package-announce/2016-February/176546.html

lists.fedoraproject.org / pipermail/package-announce/2016-February/177342.html

lists.fedoraproject.org / pipermail/package-announce/2016-February/177383.html

lists.fedoraproject.org / pipermail/package-announce/2016-January/176413.html

lists.opensuse.org / opensuse-updates/2016-02/msg00031.html

lists.opensuse.org / opensuse-updates/2016-02/msg00044.html

lists.opensuse.org / opensuse-updates/2016-02/msg00047.html

packetstormsecurity.com / files/135695/Slackware-Security-Advisory-curl-Updates.html

security.gentoo.org / glsa/201701-47

support.apple.com / HT207170

debian.org / security/2016/dsa-3455

oracle.com / technetwork/security-advisory/cpuoct2018-4428296.html

securityfocus.com / bid/82307

securitytracker.com / id/1034882

slackware.com / security/viewer.php

ubuntu.com / usn/USN-2882-1