CVE-2017-8817

critical
Published 2017-11-29 · Modified 2026-05-13
CVSS v3
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
7.5
VIR risk
9.8

Description

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

Predictions

Exploit likelihood
97%
Patch ETA

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-8817

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-8817.html

vendor Authored 2026-05-27

Vendor advisory: security@debian.org — https://curl.haxx.se/docs/adv_2017-ae72.html

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201711-33

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201711-34

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201711-35

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201711-36

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201711-38

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201711-37

OS impact

OSVersionStatusFixed in
arch archfixed7.57.0-1
suse slesaffected
debian debianbookwormfixed7.57.0-1
debian debianbullseyefixed7.57.0-1
debian debianforkyfixed7.57.0-1
debian debiansidfixed7.57.0-1
debian debiantrixiefixed7.57.0-1
debian debian8.0affected
debian debian9.0affected

Application impact

VendorProductVersionsFixed
haxxcurl{"startIncluding":"7.21.0","endIncluding":"7.56.1"}
haxxlibcurl{"startExcluding":"7.21.0","endIncluding":"7.56.1"}

References

CWEs

CWE-125

Verify integrity in audit chain (admin only). AS-IS.