curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figu

The vulnerability lies in the Curlntlmcoremknt_hash function, which calculates the size of a temporary buffer used during NTLM authentication. An attacker can trigger an integer overflow by providing a password longer than 2GB (2^31 bytes) on 32-bit systems. This overflow results in an undersized buffer being allocated, leading to a write beyond the allocated memory when the password is processed. Successful exploitation could lead to a denial-of-service condition by crashing the cURL process. While direct code execution is less likely, the potential for memory corruption raises concerns about more complex exploitation scenarios, particularly in environments where cURL is integrated with other sensitive components. Similar integer overflow vulnerabilities have historically been exploited to achieve arbitrary code execution.

Systems relying on cURL for network communication, particularly those handling user-supplied passwords or interacting with servers requiring NTLM authentication, are at risk. Applications embedding cURL within their code, such as scripting languages or build tools, are also vulnerable. Shared hosting environments where multiple users share the same cURL installation are especially susceptible.

• linux / server:

journalctl -g "curl: libcurl: buffer overflow"

• windows / supply-chain:

Get-Process curl | Where-Object {$_.WorkingSet64 -gt 1GB} # Check for unusually high memory usage

• generic web:

curl -v https://example.com/ | grep -i 'NTLM' # Check for NTLM authentication usage

1. 2018-09-05Disclosure

   disclosure

2. 2018-09-05Patch

   patch

1. Reservado2018-07-27
2. Publicada2018-09-05
3. Modificada2026-04-15

The primary mitigation is to upgrade to cURL version 7.61.2 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Disabling NTLM authentication entirely, if possible, is a strong mitigation. Alternatively, implement strict input validation on the password length before passing it to the NTLM authentication functions. Network firewalls or proxy servers can be configured to block connections using NTLM authentication. Monitor system logs for unusual activity related to cURL, such as crashes or unexpected network connections. No specific Sigma or YARA rules are readily available for this vulnerability, but monitoring for memory corruption patterns in cURL processes could be beneficial.