CVE-2016-8615 Other in curl

What is CVE-2016-8615?

CVE-2016-8615 is a medium-severity vulnerability in Haxx Curl, published on 1 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Weakness: CWE-254, CWE-99

Which versions are affected by CVE-2016-8615?

It affects 1 product.

Products include Haxx Curl.

How do I fix CVE-2016-8615?

Upgrade to a fixed version.

Is CVE-2016-8615 being exploited?

There is no known exploitation of CVE-2016-8615 in the wild and no public exploit code.

Other vulnerabilities in Haxx Curl

• CVE-2026-19931 Negotiate ambient user conn reuse Critical 9.8
• CVE-2026-10536 HTTP/2 stream-dependency tree UAF Critical 9.8
• CVE-2026-11856 cross-origin Digest auth state leak Critical 9.8
• CVE-2026-8925 SASL double-free Critical 9.8
• CVE-2026-9079 stale proxy password leak Critical 9.8

All Haxx Curl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2016-8615, CLEANSTART-2026-ZJ48818, CURL-CVE-2016-8615, DEBIAN-CVE-2016-8615, GHSA-hqqr-g92g-v6cf, UBUNTU-CVE-2016-8615.