UpHeron
All vulnerabilities

Servers and applications

CVE-2016-3739

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

Severity
Medium 5.3
Published
20 May 2016
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • Version 7.48.0
  • Version 7.47.0
  • Version 7.46.0
  • Version 7.45.0
All 37 release lines
  • Version 7.21.0
  • Version 7.21.1
  • Version 7.21.2
  • Version 7.21.3
  • Version 7.21.4
  • Version 7.21.5
  • Version 7.21.6
  • Version 7.21.7
  • Version 7.22.0
  • Version 7.23.0
  • Version 7.23.1
  • Version 7.24.0
  • Version 7.25.0
  • Version 7.26.0
  • Version 7.27.0
  • Version 7.28.0
  • Version 7.28.1
  • Version 7.29.0
  • Version 7.30.0
  • Version 7.31.0
  • Version 7.32.0
  • Version 7.33.0
  • Version 7.34.0
  • Version 7.35.0
  • Version 7.36.0
  • Version 7.38.0
  • Version 7.39.0
  • Version 7.40.0
  • Version 7.41.0
  • Version 7.42.0
  • Version 7.42.1
  • Version 7.43.0
  • Version 7.44.0
  • Version 7.45.0
  • Version 7.46.0
  • Version 7.47.0
  • Version 7.48.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3739
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3739