CVE-2016-7141: Haxx Libcurl

High severity, CVSS 7.5. EPSS: 8.2% chance of exploitation in the next 30 days.

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

Affected products

• Haxx Libcurl: up to and including 7.50.1
• Opensuse Leap: version 42.1 only

Published 2016-10-03. Last modified 2026-06-17.