CVE-2016-8625
7.5
HIGH
CVSS 3.1
EPSS 1.7%
Description
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
How to fix CVE-2016-8625
To remediate CVE-2016-8625, upgrade the affected package to a fixed version below.
- Alpine/curl—upgrade to 7.51.0-r0 or later
- Debian/curl—upgrade to 7.51.0-1 or later
Is CVE-2016-8625 being exploited?
Low — EPSS is 1.7%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 7.51.0-r0
- from 0, < 7.51.0-1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |