Daniel Stenberg maintains curl, a widely embedded command-line tool and library for data transfer that sits across countless downstream applications and systems, and also develops c-ares, a DNS resolver library with similarly broad distribution. Despite a narrow product list, these libraries' ubiquity in the software supply chain and curl's role in internet-facing workflows mean that vulnerabilities warrant attention from defenders across diverse environments, and the vendor's disclosures frequently acquire public exploit code. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Daniel Stenberg over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2000-0973HIGH Buffer overflow in curl earlier than 6.0-1.1, and curl-ssl earlier than 6.0-1.2, allows remote attackers to execute arbitrary commands by forcing a long error message to be generat | Dec 19, 2000 | 10.0 | 47 | NO | YES |
CVE-2002-1868HIGH Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields. | Dec 31, 2002 | 10.0 | 37 | NO | YES |
CVE-2006-1061HIGH Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long | Mar 21, 2006 | 7.5 | 21 | NO | NO |
CVE-2007-3152HIGH c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing | Jun 11, 2007 | 7.5 | 19 | NO | NO |
CVE-2007-3153MEDIUM The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for | Jun 11, 2007 | 5.0 | 15 | NO | NO |
CVE-2005-4077MEDIUM Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security r | Dec 8, 2005 | 4.6 | 14 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Daniel Stenberg.
Media articles that mention a CVE ID that affects a product developed by Daniel Stenberg — matched by CVE ID, not by vendor name.