UpHeron
All vulnerabilities

Servers and applications

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid…

Severity
Medium 4.0
Published
18 Apr 2014
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • Version 7.35.0
  • Version 7.34.0
  • Version 7.33.0
  • Version 7.32.0
All 10 release lines
  • Version 7.27.0
  • Version 7.28.0
  • Version 7.28.1
  • Version 7.29.0
  • Version 7.30.0
  • Version 7.31.0
  • Version 7.32.0
  • Version 7.33.0
  • Version 7.34.0
  • Version 7.35.0
curlServers and applications · cpe:a:haxx:libcurl
  • Version 7.36.0
  • Version 7.35.0
  • Version 7.34.0
  • Version 7.33.0
All 11 release lines
  • Version 7.27.0
  • Version 7.28.0
  • Version 7.28.1
  • Version 7.29.0
  • Version 7.30.0
  • Version 7.31.0
  • Version 7.32.0
  • Version 7.33.0
  • Version 7.34.0
  • Version 7.35.0
  • Version 7.36.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-2522
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-2522