UpHeron
All vulnerabilities

Servers and applications

CVE-2014-3613

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.

Severity
Medium 5.0
Published
18 Nov 2014
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • Version 7.37.0
  • Version 7.36.0
  • Version 7.35.0
  • Version 7.34.0
All 8 release lines
  • Every version up to 7.37.1
  • Version 7.31.0
  • Version 7.32.0
  • Version 7.33.0
  • Version 7.34.0
  • Version 7.35.0
  • Version 7.36.0
  • Version 7.37.0
curlServers and applications · cpe:a:haxx:libcurl
  • Version 7.37.0
  • Version 7.36.0
  • Version 7.35.0
  • Version 7.34.0
All 8 release lines
  • Every version up to 7.37.1
  • Version 7.31.0
  • Version 7.32.0
  • Version 7.33.0
  • Version 7.34.0
  • Version 7.35.0
  • Version 7.36.0
  • Version 7.37.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-3613
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-3613