CVE-2020-19909 Integer overflow in n/a
An integer overflow in curl's retry delay handling could theoretically cause denial of service if misconfigured, though direct security impact is minimal.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-19909?
CVE-2020-19909 is a low-severity vulnerability in Haxx Curl, published on 22 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.
Weakness: CWE-190
Which versions are affected by CVE-2020-19909?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2020-19909?
Upgrade to a fixed version.
Is CVE-2020-19909 being exploited?
There is no known exploitation of CVE-2020-19909 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as DEBIAN-CVE-2020-19909, GHSA-2792-x8v5-77wp.