CVE-2016-8618: Haxx Curl

Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days.

The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.

Affected products

• Haxx Curl: before 7.51.0 (fixed in 7.51.0)

Published 2018-07-31. Last modified 2026-06-17.