CVE-2016-9594: Haxx Curl

High severity, CVSS 8.1. EPSS: 2.2% chance of exploitation in the next 30 days.

curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable.

Affected products

• Haxx Curl: before 7.52.1 (fixed in 7.52.1)

Published 2018-04-23. Last modified 2026-06-17.