CVE-2009-0037: Curl

Medium severity, CVSS 6.8. EPSS: 9.1% chance of exploitation in the next 30 days.

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

Affected products

• Curl Curl: version 5.11 only; version 6.0 only; version 6.1beta only; version 6.2 only; version 6.3 only; version 6.3.1 only; …
• Curl Libcurl: version 5.11 only; version 7.12 only; version 7.12.1 only; version 7.12.2 only; version 7.12.3 only; version 7.13 only; …

Published 2009-03-05. Last modified 2026-06-16.